SCF Assessment Objectives

Sagslinks
Titel	Beskrivelse
GOV-01 Security, Compliance & Resilience Governance Policy – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: GOV-01_A01 a formal, documented security, compliance and resilience governance policy is approved by executive management, or a formally delegated authority, and conveys executive management's intent for security, compliance and resilience governance. Assessment rigor: 1 Origin: SCF Created GOV-01_A02 the security, compliance and resilience governance policy provides organizational direction and states the behaviors expected of personnel and other applicable parties with respect to security, compliance and resilience governance. Assessment rigor: 1 Origin: SCF Created GOV-01_A03 the current version of the security, compliance and resilience governance policy is communicated to, and accessible by, the personnel and other applicable parties who are expected to comply with it. Assessment rigor: 1 Origin: SCF Created GOV-01_A04 the security, compliance and resilience governance policy is reviewed at least annually. Defined parameters: at least annually Assessment rigor: 1 Origin: SCF Created GOV-01_A05 the security, compliance and resilience governance policy is updated, as necessary, in response to changes in risks, threats, business practices and/or statutory, regulatory and contractual obligations that affect the organization. Assessment rigor: 1 Origin: SCF Created
GOV-02 Security, Compliance & Resilience Program (SCRP) – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: GOV-02_A01 an organization-wide cybersecurity / data privacy governance program is developed. Assessment rigor: 1 Origin: 53A_R5_PM-01a.[01] GOV-02_A02 the cybersecurity / data privacy governance program addresses management commitment. Assessment rigor: 1 Origin: 53A_R5_PM-01a.02[03] GOV-02_A03 the cybersecurity / data privacy governance program addresses statutory, regulatory and/or contractual compliance obligations. Assessment rigor: 1 Origin: 53A_R5_PM-01a.02[05] GOV-02_A04 the cybersecurity / data privacy governance program is protected from unauthorized disclosure. Assessment rigor: 3 Origin: 53A_R5_PM-01c.[01] GOV-02_A05 the cybersecurity / data privacy governance program is protected from unauthorized modification. Assessment rigor: 3 Origin: 53A_R5_PM-01c.[02] GOV-02_A06 the cybersecurity / data privacy governance program is disseminated. Assessment rigor: 3 Origin: 53A_R5_PM-01a.[02] GOV-02_A07 the cybersecurity / data privacy governance program provides an overview of the requirements for the security program. Assessment rigor: 3 Origin: 53A_R5_PM-01a.01[01] GOV-02_A08 the cybersecurity / data privacy governance program provides a description of the security program management controls in place or planned for meeting those requirements. Assessment rigor: 3 Origin: 53A_R5_PM-01a.01[02] GOV-02_A09 the cybersecurity / data privacy governance program provides a description of the common controls in place or planned for meeting those requirements. Assessment rigor: 3 Origin: 53A_R5_PM-01a.01[03] GOV-02_A10 the cybersecurity / data privacy governance program includes the identification and assignment of roles. Assessment rigor: 3 Origin: 53A_R5_PM-01a.02[01] GOV-02_A11 the cybersecurity / data privacy governance program includes the identification and assignment of responsibilities. Assessment rigor: 3 Origin: 53A_R5_PM-01a.02[02] GOV-02_A12 the cybersecurity / data privacy governance program addresses coordination among organizational entities. Assessment rigor: 3 Origin: 53A_R5_PM-01a.02[04] GOV-02_A13 the cybersecurity / data privacy governance program reflects the coordination among the organizational entities responsible for cybersecurity / data privacy. Assessment rigor: 3 Origin: 53A_R5_PM-01a.03 GOV-02_A14 the cybersecurity / data privacy governance program is approved by a senior official with responsibility and accountability for the risk being incurred to organizational operations. Assessment rigor: 3 Origin: 53A_R5_PM-01a.04 GOV-02_A15 the frequency at which to review / update the organization-wide cybersecurity / data privacy governance program is defined. Defined parameters: at least annually Assessment rigor: 3 Origin: 53A_R5_PM-01_ODP[01] GOV-02_A16 events that trigger the review / update of the organization-wide cybersecurity / data privacy governance program are defined. Assessment rigor: 3 Origin: 53A_R5_PM-01_ODP[02] GOV-02_A17 the cybersecurity / data privacy governance program is reviewed / updated frequently. Assessment rigor: 3 Origin: 53A_R5_PM-01b.[01] GOV-02_A18 the cybersecurity / data privacy governance program is reviewed / updated following events. Assessment rigor: 3 Origin: 53A_R5_PM-01b.[02] GOV-02_A19 cybersecurity & data protection governance operations are conducted according to documented policies, standards, procedures and/or other organizational directives. Assessment rigor: 1 Origin: SCF Created GOV-02_A20 resources are assigned to support cybersecurity & data protection governance operations (e.g., people, processes, technologies, data and/or facilities) Assessment rigor: 1 Origin: SCF Created GOV-02_A21 responsibility and authority for the performance of cybersecurity & data protection governance-related activities are assigned to designated personnel. Assessment rigor: 1 Origin: SCF Created GOV-02_A22 personnel performing cybersecurity & data protection governance-related activities have the skills and knowledge needed to perform their assigned duties. Assessment rigor: 2 Origin: SCF Created GOV-02_A23 the design of security, compliance and resilience governance controls is documented. Assessment rigor: 1 Origin: SCF Created GOV-02_A24 security, compliance and resilience governance controls are monitored to determine whether they are implemented and operating as designed. Assessment rigor: 1 Origin: SCF Created
GOV-03 Centralized Management of Security, Compliance & Resilience Controls – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: GOV-03_A01 the security, compliance and resilience controls and related processes to be centrally managed are defined. Assessment rigor: 1 Origin: 53A_R5_PL-09_ODP GOV-03_A02 the defined security, compliance and resilience controls are centrally managed. Assessment rigor: 1 Origin: 53A_R5_PL-09 GOV-03_A03 the defined security, compliance and resilience-related processes are centrally managed. Assessment rigor: 1 Origin: SCF Created
GOV-03.1 Secure Practices Alignment Justification – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: GOV-03.1_A01 the organization's Security, Compliance & Resilience Program (SCRP) is aligned with one or more industry-recognized frameworks. Assessment rigor: 1 Origin: SCF Created GOV-03.1_A02 documented justification for the organization's secure practices cites the industry-recognized framework(s) with which the Security, Compliance & Resilience Program (SCRP) is aligned. Assessment rigor: 1 Origin: SCF Created
GOV-03.2 Standardized Terminology – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: GOV-03.2_A01 technology and process terminology is standardized to reduce confusion amongst groups and departments. Assessment rigor: 1 Origin: SCF Created
GOV-03.3 Control Objectives – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: GOV-03.3_A01 control objectives are established as the basis for the design, selection, implementation and management of the organization's internal security, compliance and resilience control system. Assessment rigor: 1 Origin: SCF Created
GOV-03.4 Assessment Objectives (AO) – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: GOV-03.4_A01 the Assessment Objectives (AO) available for assessing the implementation of requirements are identified. Assessment rigor: 1 Origin: SCF Created GOV-03.4_A02 Assessment Objectives (AO) are used to assess the implementation of requirements, when available. Assessment rigor: 1 Origin: SCF Created
GOV-04 Publishing Security, Compliance & Resilience Documentation – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: GOV-04_A01 cybersecurity / data privacy policies are developed and documented. Assessment rigor: 1 Origin: 53A_R5_AC-01a.[01] 53A_R5_AT-01a.[01] 53A_R5_AU-01a.[01] 53A_R5_CA-01a.[01] 53A_R5_CM-01a.[01] 53A_R5_CP-01a.[01] 53A_R5_IA-01a.[01] 53A_R5_IR-01a.[01] 53A_R5_MA-01a.[01] 53A_R5_MP-01a.[01] 53A_R5_PE-01a.[01] 53A_R5_PL-01a.[01] 53A_R5_PS-01a.[01] 53A_R5_PT-01a.[01] 53A_R5_RA-01a.[01] 53A_R5_SA-01a.[01] 53A_R5_SC-01a.[01] 53A_R5_SI-01a.[01] 53A_R5_SR-01a.[01] 171A_3.4.9[a] 171A_3.9.2[a] 53A_R5_AC-02a.[03] 53A_R5_AC-04(25)_ODP[02] 53A_R5_IA-04(05)_ODP 53A_R5_SR-11a.[03] GOV-04_A02 policies needed to satisfy the security requirements for the protection of sensitive / regulated data are developed and documented. Defined parameters: at least annually Assessment rigor: 1 Origin: SCF Created GOV-04_A03 policies needed to satisfy the security requirements for the protection of sensitive / regulated data are disseminated to organizational personnel or roles. Assessment rigor: 1 Origin: SCF Created GOV-04_A04 procedures needed to satisfy the security requirements for the protection of sensitive / regulated data are developed and documented. Defined parameters: at least annually Assessment rigor: 1 Origin: SCF Created GOV-04_A05 procedures needed to satisfy the security requirements for the protection of sensitive / regulated data are disseminated to organizational personnel or roles. Assessment rigor: 1 Origin: SCF Created GOV-04_A06 the cybersecurity / data privacy policies address purpose. Assessment rigor: 3 Origin: 53A_R5_AC-01a.01(a)[01] 53A_R5_AT-01a.01(a)[01] 53A_R5_AU-01a.01(a)[01] 53A_R5_CA-01a.01(a)[01] 53A_R5_CM-01a.01(a)[01] 53A_R5_CP-01a.01(a)[01] 53A_R5_IA-01a.01(a)[01] 53A_R5_IR-01a.01(a)[01] 53A_R5_MA-01a.01(a)[01] 53A_R5_MP-01a.01(a)[01] 53A_R5_PE-01a.01(a)[01] 53A_R5_PL-01a.01(a)[01] 53A_R5_PS-01a.01(a)[01] 53A_R5_PT-01a.01(a)[01] 53A_R5_RA-01a.01(a)[01] 53A_R5_SA-01a.01(a)[01] 53A_R5_SC-01a.01(a)[01] 53A_R5_SI-01a.01(a)[01] 53A_R5_SR-01a.01(a)[01] GOV-04_A07 the cybersecurity / data privacy policies address scope. Assessment rigor: 3 Origin: 53A_R5_AC-01a.01(a)[02] 53A_R5_AT-01a.01(a)[02] 53A_R5_AU-01a.01(a)[02] 53A_R5_CA-01a.01(a)[02] 53A_R5_CM-01a.01(a)[02] 53A_R5_CP-01a.01(a)[02] 53A_R5_IA-01a.01(a)[02] 53A_R5_IR-01a.01(a)[02] 53A_R5_MA-01a.01(a)[02] 53A_R5_MP-01a.01(a)[02] 53A_R5_PE-01a.01(a)[02] 53A_R5_PL-01a.01(a)[02] 53A_R5_PS-01a.01(a)[02] 53A_R5_PT-01a.01(a)[02] 53A_R5_RA-01a.01(a)[02] 53A_R5_SA-01a.01(a)[02] 53A_R5_SC-01a.01(a)[02] 53A_R5_SI-01a.01(a)[02] 53A_R5_SR-01a.01(a)[02] GOV-04_A08 the cybersecurity / data privacy policies address roles. Assessment rigor: 3 Origin: 53A_R5_AC-01a.01(a)[03] 53A_R5_AT-01a.01(a)[03] 53A_R5_AU-01a.01(a)[03] 53A_R5_CA-01a.01(a)[03] 53A_R5_CM-01a.01(a)[03] 53A_R5_CP-01a.01(a)[03] 53A_R5_IA-01a.01(a)[03] 53A_R5_IR-01a.01(a)[03] 53A_R5_MA-01a.01(a)[03] 53A_R5_MP-01a.01(a)[03] 53A_R5_PE-01a.01(a)[03] 53A_R5_PL-01a.01(a)[03] 53A_R5_PS-01a.01(a)[03] 53A_R5_PT-01a.01(a)[03] 53A_R5_RA-01a.01(a)[03] 53A_R5_SA-01a.01(a)[03] 53A_R5_SC-01a.01(a)[03] 53A_R5_SI-01a.01(a)[03] 53A_R5_SR-01a.01(a)[03] GOV-04_A09 the cybersecurity / data privacy policies address responsibilities. Assessment rigor: 3 Origin: 53A_R5_AC-01a.01(a)[04] 53A_R5_AT-01a.01(a)[04] 53A_R5_AU-01a.01(a)[04] 53A_R5_CA-01a.01(a)[04] 53A_R5_CM-01a.01(a)[04] 53A_R5_CP-01a.01(a)[04] 53A_R5_IA-01a.01(a)[04] 53A_R5_IR-01a.01(a)[04] 53A_R5_MA-01a.01(a)[04] 53A_R5_MP-01a.01(a)[04] 53A_R5_PE-01a.01(a)[04] 53A_R5_PL-01a.01(a)[04] 53A_R5_PS-01a.01(a)[04] 53A_R5_PT-01a.01(a)[04] 53A_R5_RA-01a.01(a)[04] 53A_R5_SA-01a.01(a)[04] 53A_R5_SC-01a.01(a)[04] 53A_R5_SI-01a.01(a)[04] 53A_R5_SR-01a.01(a)[04] GOV-04_A10 the cybersecurity / data privacy policies address management commitment. Assessment rigor: 3 Origin: 53A_R5_AC-01a.01(a)[05] 53A_R5_AT-01a.01(a)[05] 53A_R5_AU-01a.01(a)[05] 53A_R5_CA-01a.01(a)[05] 53A_R5_CM-01a.01(a)[05] 53A_R5_CP-01a.01(a)[05] 53A_R5_IA-01a.01(a)[05] 53A_R5_IR-01a.01(a)[05] 53A_R5_MA-01a.01(a)[05] 53A_R5_MP-01a.01(a)[05] 53A_R5_PE-01a.01(a)[05] 53A_R5_PL-01a.01(a)[05] 53A_R5_PS-01a.01(a)[05] 53A_R5_PT-01a.01(a)[05] 53A_R5_RA-01a.01(a)[05] 53A_R5_SA-01a.01(a)[05] 53A_R5_SC-01a.01(a)[05] 53A_R5_SI-01a.01(a)[05] 53A_R5_SR-01a.01(a)[05] GOV-04_A11 the cybersecurity / data privacy policies address coordination among organizational entities. Assessment rigor: 3 Origin: 53A_R5_AC-01a.01(a)[06] 53A_R5_AT-01a.01(a)[06] 53A_R5_AU-01a.01(a)[06] 53A_R5_CA-01a.01(a)[06] 53A_R5_CM-01a.01(a)[06] 53A_R5_CP-01a.01(a)[06] 53A_R5_IA-01a.01(a)[06] 53A_R5_IR-01a.01(a)[06] 53A_R5_MA-01a.01(a)[06] 53A_R5_MP-01a.01(a)[06] 53A_R5_PE-01a.01(a)[06] 53A_R5_PL-01a.01(a)[06] 53A_R5_PS-01a.01(a)[06] 53A_R5_PT-01a.01(a)[06] 53A_R5_RA-01a.01(a)[06] 53A_R5_SA-01a.01(a)[06] 53A_R5_SC-01a.01(a)[06] 53A_R5_SI-01a.01(a)[06] 53A_R5_SR-01a.01(a)[06] GOV-04_A12 the cybersecurity / data privacy policies address compliance. Assessment rigor: 3 Origin: 53A_R5_AC-01a.01(a)[07] 53A_R5_AT-01a.01(a)[07] 53A_R5_AU-01a.01(a)[07] 53A_R5_CA-01a.01(a)[07] 53A_R5_CM-01a.01(a)[07] 53A_R5_CP-01a.01(a)[07] 53A_R5_IA-01a.01(a)[07] 53A_R5_IR-01a.01(a)[07] 53A_R5_MA-01a.01(a)[07] 53A_R5_MP-01a.01(a)[07] 53A_R5_PE-01a.01(a)[07] 53A_R5_PL-01a.01(a)[07] 53A_R5_PS-01a.01(a)[07] 53A_R5_PT-01a.01(a)[07] 53A_R5_RA-01a.01(a)[07] 53A_R5_SA-01a.01(a)[07] 53A_R5_SC-01a.01(a)[07] 53A_R5_SI-01a.01(a)[07] 53A_R5_SR-01a.01(a)[07] GOV-04_A13 the cybersecurity / data privacy policies are consistent with applicable laws, regulations and contractual obligations. Assessment rigor: 3 Origin: 53A_R5_AC-01a.01(b) 53A_R5_AT-01a.01(b) 53A_R5_AU-01a.01(b) 53A_R5_CA-01a.01(b) 53A_R5_CM-01a.01(b) 53A_R5_CP-01a.01(b) 53A_R5_IA-01a.01(b) 53A_R5_IR-01a.01(b) 53A_R5_MA-01a.01(b) 53A_R5_MP-01a.01(b) 53A_R5_PE-01a.01(b) 53A_R5_PL-01a.01(b) 53A_R5_PS-01a.01(b) 53A_R5_PT-01a.01(b) 53A_R5_RA-01a.01(b) 53A_R5_SA-01a.01(b) 53A_R5_SC-01a.01(b) 53A_R5_SI-01a.01(b) 53A_R5_SR-01a.01(b) GOV-04_A14 personnel or roles to whom the cybersecurity / data privacy policies are to be disseminated is/are defined. Assessment rigor: 3 Origin: 53A_R5_AC-01_ODP[01] 53A_R5_AT-01_ODP[01] 53A_R5_AU-01_ODP[01] 53A_R5_CA-01_ODP[01] 53A_R5_CM-01_ODP[01] 53A_R5_CP-01_ODP[01] 53A_R5_IA-01_ODP[01] 53A_R5_IR-01_ODP[01] 53A_R5_MA-01_ODP[01] 53A_R5_MP-01_ODP[01] 53A_R5_PE-01_ODP[01] 53A_R5_PL-01_ODP[01] 53A_R5_PS-01_ODP[01] 53A_R5_PT-01_ODP[01] 53A_R5_RA-01_ODP[01] 53A_R5_SA-01_ODP[01] 53A_R5_SC-01_ODP[01] 53A_R5_SI-01_ODP[01] 53A_R5_SR-01_ODP[01] GOV-04_A15 the cybersecurity / data privacy policies are disseminated to personnel or roles. Assessment rigor: 3 Origin: 53A_R5_AC-01a.[02] 53A_R5_AT-01a.[02] 53A_R5_AU-01a.[02] 53A_R5_CA-01a.[02] 53A_R5_CM-01a.[02] 53A_R5_CP-01a.[02] 53A_R5_IA-01a.[02] 53A_R5_IR-01a.[02] 53A_R5_MA-01a.[02] 53A_R5_MP-01a.[02] 53A_R5_PE-01a.[02] 53A_R5_PL-01a.[02] 53A_R5_PS-01a.[02] 53A_R5_PT-01a.[02] 53A_R5_RA-01a.[02] 53A_R5_SA-01a.[02] 53A_R5_SC-01a.[02] 53A_R5_SI-01a.[02] 53A_R5_SR-01a.[02] GOV-04_A16 the official is designated to manage the development, documentation and dissemination of the cybersecurity / data privacy policies and procedures. Assessment rigor: 3 Origin: 53A_R5_AC-01b 53A_R5_AT-01b 53A_R5_AU-01b 53A_R5_CA-01b 53A_R5_CM-01b 53A_R5_CP-01b 53A_R5_IA-01b 53A_R5_IR-01b 53A_R5_MA-01b 53A_R5_MP-01b 53A_R5_PE-01b 53A_R5_PL-01b 53A_R5_PS-01b 53A_R5_PT-01b 53A_R5_RA-01b 53A_R5_SA-01b 53A_R5_SC-01b 53A_R5_SI-01b 53A_R5_SR-01b GOV-04_A17 an official to manage the governance of cybersecurity / data privacy policies and procedures is defined. Assessment rigor: 2 Origin: 53A_R5_AC-01_ODP[04] 53A_R5_AT-01_ODP[04] 53A_R5_AU-01_ODP[04] 53A_R5_CA-01_ODP[04] 53A_R5_CM-01_ODP[04] 53A_R5_CP-01_ODP[04] 53A_R5_IA-01_ODP[04] 53A_R5_IR-01_ODP[04] 53A_R5_MA-01_ODP[04] 53A_R5_MP-01_ODP[04] 53A_R5_PE-01_ODP[04] 53A_R5_PL-01_ODP[04] 53A_R5_PS-01_ODP[04] 53A_R5_PT-01_ODP[04] 53A_R5_RA-01_ODP[04] 53A_R5_SA-01_ODP[04] 53A_R5_SC-01_ODP[04] 53A_R5_SI-01_ODP[04] 53A_R5_SR-01_ODP[04] 171A_3.4.9[a] 171A_3.9.2[a] 53A_R5_AC-02a.[03] 53A_R5_AC-04(25)_ODP[02] 53A_R5_IA-04(05)_ODP 53A_R5_SR-11a.[03] GOV-04_A18 policies needed to satisfy the security requirements for the protection of CUI are developed and documented. Assessment rigor: NIST 800-171 Origin: 171A_R3_A.03.15.01.a[01] GOV-04_A19 policies needed to satisfy the security requirements for the protection of CUI are disseminated to organizational personnel or roles. Assessment rigor: NIST 800-171 Origin: 171A_R3_A.03.15.01.a[02] GOV-04_A20 procedures needed to satisfy the security requirements for the protection of CUI are developed and documented. Assessment rigor: NIST 800-171 Origin: 171A_R3_A.03.15.01.a[03] GOV-04_A21 procedures needed to satisfy the security requirements for the protection of CUI are disseminated to organizational personnel or roles. Assessment rigor: NIST 800-171 Origin: 171A_R3_A.03.15.01.a[04]
GOV-04.1 Periodic Review & Update of Security, Compliance & Resilience Program – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: GOV-04.1_A01 the frequency at which the policies and procedures for satisfying security requirements are reviewed and updated is defined. Defined parameters: at least annually Assessment rigor: 1 Origin: 171A_R3_A.03.15.01.ODP[01] 53A_R5_AC-01_ODP[05] 53A_R5_AT-01_ODP[05] 53A_R5_AU-01_ODP[05] 53A_R5_CA-01_ODP[05] 53A_R5_CM-01_ODP[05] 53A_R5_CP-01_ODP[05] 53A_R5_IA-01_ODP[05] 53A_R5_IR-01_ODP[05] 53A_R5_MA-01_ODP[05] 53A_R5_MP-01_ODP[05] 53A_R5_PE-01_ODP[05] 53A_R5_PL-01_ODP[05] 53A_R5_PS-01_ODP[05] 53A_R5_PT-01_ODP[05] 53A_R5_RA-01_ODP[05] 53A_R5_SA-01_ODP[05] 53A_R5_SC-01_ODP[05] 53A_R5_SI-01_ODP[05] 53A_R5_SR-01_ODP[05] GOV-04.1_A02 policies and procedures are reviewed / updated per an organization-defined frequency. Defined parameters: Review policies, standards and procedures at least annual and following significant changes Assessment rigor: 1 Origin: 53A_R5_AC-01c.01[01] 53A_R5_AC-01c.01[02] 53A_R5_AT-01c.01[01] 53A_R5_AT-01c.01[02] 53A_R5_AU-01c.01[01] 53A_R5_AU-01c.01[02] 53A_R5_CA-01c.01[01] 53A_R5_CA-01c.01[02] 53A_R5_CM-01c.01[01] 53A_R5_CM-01c.01[02] 53A_R5_CP-01c.01[01] 53A_R5_CP-01c.01[02] 53A_R5_IA-01c.01[01] 53A_R5_IA-01c.01[02] 53A_R5_IR-01c.01[01] 53A_R5_IR-01c.01[02] 53A_R5_MA-01c.01[01] 53A_R5_MA-01c.01[02] 53A_R5_MP-01c.01[01] 53A_R5_MP-01c.01[02] 53A_R5_PE-01c.01[01] 53A_R5_PE-01c.01[02] 53A_R5_PL-01c.01[01] 53A_R5_PL-01c.01[02] 53A_R5_PS-01c.01[01] 53A_R5_PS-01c.01[02] 53A_R5_PT-01c.01[01] 53A_R5_PT-01c.01[02] 53A_R5_RA-01c.01[01] 53A_R5_RA-01c.01[02] 53A_R5_SA-01c.01[01] 53A_R5_SA-01c.01[02] 53A_R5_SC-01c.01[01] 53A_R5_SC-01c.01[02] 53A_R5_SI-01c.01[01] 53A_R5_SI-01c.01[02] 53A_R5_SR-01c.01[01] 53A_R5_SR-01c.01[02] GOV-04.1_A03 events that would require the current cybersecurity / data privacy policies to be reviewed / updated are defined. Defined parameters: significant changes Assessment rigor: 3 Origin: 53A_R5_AC-01_ODP[06] 53A_R5_AT-01_ODP[06] 53A_R5_AU-01_ODP[06] 53A_R5_CA-01_ODP[06] 53A_R5_CM-01_ODP[06] 53A_R5_CP-01_ODP[06] 53A_R5_IA-01_ODP[06] 53A_R5_IR-01_ODP[06] 53A_R5_MA-01_ODP[06] 53A_R5_MP-01_ODP[06] 53A_R5_PE-01_ODP[06] 53A_R5_PL-01_ODP[06] 53A_R5_PS-01_ODP[06] 53A_R5_PT-01_ODP[06] 53A_R5_RA-01_ODP[06] 53A_R5_SA-01_ODP[06] 53A_R5_SC-01_ODP[06] 53A_R5_SI-01_ODP[06] 53A_R5_SR-01_ODP[06] GOV-04.1_A04 policies and procedures are reviewed <A.03.15.01.ODP[01]: frequency>. Defined parameters: at least every 12 months, or when there are significant incidents or significant changes to risks Assessment rigor: NIST 800-171 Origin: 171A_R3_A.03.15.01.b[01] GOV-04.1_A05 policies and procedures are updated <A.03.15.01.ODP[01]: frequency>. Defined parameters: at least every 12 months, or when there are significant incidents or significant changes to risks Assessment rigor: NIST 800-171 Origin: 171A_R3_A.03.15.01.b[02]
GOV-04.2 Exception Management – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: GOV-04.2_A01 exception requests to standards are formally submitted for review, along with a business justification for the deviation and proposed compensating controls. Assessment rigor: 1 Origin: SCF Created GOV-04.2_A02 the exception request undergoes a risk assessment to evaluate the business justification and proposed compensating controls. Assessment rigor: 1 Origin: SCF Created GOV-04.2_A03 a documented determination is made to approve or deny the exception request. Assessment rigor: 1 Origin: SCF Created GOV-04.2_A04 the requestor of the exception is provided a documented response on the determination, within an organization-defined period, that states any actions required of the requestor. Defined parameters: no more than 10 business days after the determination is made Assessment rigor: 1 Origin: SCF Created
GOV-04.3 Periodic Review of Exceptions – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: GOV-04.3_A01 the frequency at which to review approved exceptions is defined. Defined parameters: at least annually Assessment rigor: 1 Origin: SCF Created GOV-04.3_A02 approved exceptions are reviewed at the defined frequency against current risks and threats. Assessment rigor: 1 Origin: SCF Created GOV-04.3_A03 the determination of whether a reviewed exception is allowed to continue is documented, including the rationale and the approving individual or role. Assessment rigor: 1 Origin: SCF Created GOV-04.3_A04 exceptions determined not to continue are closed and the underlying non-conformity is remediated or re-submitted for approval. Assessment rigor: 1 Origin: SCF Created GOV-04.3_A05 records of exception reviews are retained that evidence the review date, the risks and threats considered and the continuation decision. Assessment rigor: 2 Origin: SCF Created
GOV-05 Assigned Security, Compliance & Resilience Responsibilities – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: GOV-05_A01 a senior organizational cybersecurity position is appointed. Assessment rigor: 1 Origin: 53A_R5_PM-02[01] GOV-05_A02 the senior organizational cybersecurity position is provided with the mission and resources to coordinate, develop, implement and maintain an organization-wide cybersecurity program. Assessment rigor: 1 Origin: 53A_R5_PM-02[02] 53A_R5_PM-02[03] 53A_R5_PM-02[04] 53A_R5_PM-02[05]
GOV-05.1 Stakeholder Accountability Structure – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: GOV-05.1_A01 the cybersecurity / data privacy governance program includes the identification and assignment of roles. Assessment rigor: 1 Origin: 53A_R5_PM-01a.02[01] GOV-05.1_A02 the cybersecurity / data privacy governance program includes the identification and assignment of responsibilities. Assessment rigor: 1 Origin: 53A_R5_PM-01a.02[02] GOV-05.1_A03 an accountability structure identifies the teams and individuals responsible for identifying, mapping, measuring and managing Technology Assets, Applications, Services and/or Data (TAASD)-related risks. Assessment rigor: 1 Origin: SCF Created GOV-05.1_A04 teams and individuals responsible for identifying, mapping, measuring and managing Technology Assets, Applications, Services and/or Data (TAASD)-related risks are trained for those responsibilities. Assessment rigor: 1 Origin: SCF Created
GOV-05.2 Authoritative Chain of Command – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: GOV-05.2_A01 a formal organization structure is published. Defined parameters: at least annually Assessment rigor: 1 Origin: SCF Created GOV-05.2_A02 each individual's reporting line within the chain of command is documented. Assessment rigor: 1 Origin: SCF Created
GOV-06 Defining Business Context & Mission – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: GOV-06_A01 the organization's mission is defined and documented. Assessment rigor: 1 Origin: SCF Created GOV-06_A02 the organization's business model is documented. Assessment rigor: 1 Origin: SCF Created
GOV-07 Materiality Determination – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: GOV-07_A01 organization-specific criteria to define a materiality threshold capable of designating an incident as material are documented. Assessment rigor: 1 Origin: SCF Created
GOV-08 High Value Assets (HVAs) – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: GOV-08_A01 a High Value Assets (HVAs) catalog is created. Defined parameters: at least annually Assessment rigor: 1 Origin: SCF Created GOV-08_A02 criteria are defined for high-value Intellectual Property (IP) to be categorized as a High Value Asset (HVA). Assessment rigor: 1 Origin: SCF Created GOV-08_A03 criteria are defined for Technology Assets, Applications and Services (TAAS) to be categorized as a High Value Asset (HVA), based on business process criticality or dependency relationships. Assessment rigor: 1 Origin: SCF Created GOV-08_A04 the physical and/or logical location of HVAs is documented. Assessment rigor: 1 Origin: SCF Created GOV-08_A05 assigned owners are defined for HVAs. Assessment rigor: 1 Origin: SCF Created GOV-08_A06 minimum protection mechanisms for HVAs are defined. Assessment rigor: 1 Origin: SCF Created GOV-08_A07 assurance requirements for HVAs are defined. Assessment rigor: 1 Origin: SCF Created
GOV-09 Steering Committee & Program Oversight – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: GOV-09_A01 an executive steering committee, or advisory board, is formed and is comprised of key cybersecurity, technology, risk, privacy and business executives. Assessment rigor: 1 Origin: SCF Created GOV-09_A02 the executive steering committee, or advisory board, coordinates cybersecurity, technology, risk, privacy and business alignment through formal meetings held per an organization-defined frequency. Defined parameters: at least quarterly Assessment rigor: 1 Origin: SCF Created
GOV-09.1 Status Reporting To Governing Body – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: GOV-09.1_A01 governance oversight reporting and recommendations on matters considered material to the organization's Security, Compliance & Resilience Program (SCRP) are provided to executives, per an organization-defined frequency, to enable decisions on those matters. Defined parameters: at least quarterly Assessment rigor: 1 Origin: SCF Created GOV-09.1_A02 the frequency at which governance oversight reporting and recommendations are provided to executives is defined. Defined parameters: at least quarterly Assessment rigor: 1 Origin: SCF Created
GOV-10 Business As Usual (BAU) Security, Compliance & Resilience Practices – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: GOV-10_A01 the executive steering committee, or advisory board, directs organization leadership to incorporate cybersecurity / data privacy principles into Business As Usual (BAU) practices. Assessment rigor: 1 Origin: SCF Created GOV-10_A02 cybersecurity incidents are reviewed to identify incidents that occurred due to cybersecurity / data privacy principles not being adopted as Business As Usual (BAU) practices. Defined parameters: at least annually Assessment rigor: 1 Origin: SCF Created GOV-10_A03 identified deficiencies of cybersecurity / data privacy principles not being adopted as Business As Usual (BAU) practices are tracked via a Plan of Action and Milestones (POA&M), or risk register, through remediation. Defined parameters: at least quarterly Assessment rigor: 1 Origin: SCF Created
GOV-11 Operationalizing Security, Compliance & Resilience Capabilities – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: GOV-11_A01 roles and responsibilities exist to compel data and/or process owners to operationalize security, compliance and resilience practices for the Technology Assets, Applications, Services and/or Data (TAASD) under their control. Assessment rigor: 1 Origin: SCF Created GOV-11_A02 Individual Contributor (IC) performance reviews cover how data and/or process owners operationalized security, compliance and resilience practices for the Technology Assets, Applications, Services and/or Data (TAASD) under their control. Defined parameters: at least annually Assessment rigor: 1 Origin: SCF Created GOV-11_A03 organization-defined systems security engineering principles are applied to the development or modification of the system and system components. Defined parameters: at a minimum, the systems security engineering principles described in NIST SP 800-160 Assessment rigor: 3 Origin: SCF Created GOV-11_A04 <A.03.16.01.ODP[01]: systems security engineering principles> are applied to the development or modification of the system and system components. Defined parameters: Guidance: At a minimum, documentation that provides user and administrator guidance for the implementation and operation of controls. The level of detail required in such documentation should be based on the degree to which organizations depend on the capabilities, functions, or mechanisms to meet risk response expectations. Requirements can include mandated configuration settings that specify allowed functions, ports, protocols, and services. Acceptance criteria for systems, system components, and system services are defined in the same manner as the criteria for any organizational acquisition or procurement. Assessment rigor: NIST 800-171 Origin: 171A_R3_A.03.16.01
GOV-11.1 Select Controls – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: GOV-11.1_A01 roles and responsibilities exist to compel data and/or process owners to select required security, compliance and resilience controls for the Technology Assets, Applications, Services and/or Data (TAASD) under their control. Assessment rigor: 1 Origin: SCF Created GOV-11.1_A02 Individual Contributor (IC) performance reviews cover how data and/or process owners select required security, compliance and resilience controls for the Technology Assets, Applications, Services and/or Data (TAASD) under their control. Defined parameters: at least annually Assessment rigor: 1 Origin: SCF Created
GOV-11.2 Implement Controls – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: GOV-11.2_A01 roles and responsibilities exist to compel data and/or process owners to implement required security, compliance and resilience controls for the Technology Assets, Applications, Services and/or Data (TAASD) under their control. Assessment rigor: 1 Origin: SCF Created GOV-11.2_A02 Individual Contributor (IC) performance reviews cover how data and/or process owners implement required security, compliance and resilience controls for the Technology Assets, Applications, Services and/or Data (TAASD) under their control. Defined parameters: at least annually Assessment rigor: 1 Origin: SCF Created
GOV-11.3 Assess Controls – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: GOV-11.3_A01 roles and responsibilities exist to compel data and/or process owners to assess if required security, compliance and resilience controls for the Technology Assets, Applications, Services and/or Data (TAASD) under their control are designed to meet control objectives, implemented correctly and operating as intended. Assessment rigor: 1 Origin: SCF Created GOV-11.3_A02 Individual Contributor (IC) performance reviews cover how data and/or process owners assess if required security, compliance and resilience controls for the Technology Assets, Applications, Services and/or Data (TAASD) under their control are designed to meet control objectives, implemented correctly and operating as intended. Defined parameters: at least annually Assessment rigor: 2 Origin: SCF Created GOV-11.3_A03 data and/or process owners assess whether required security, compliance and resilience controls for the Technology Assets, Applications, Services and/or Data (TAASD) under their control are designed to meet control objectives. Assessment rigor: 1 Origin: SCF Created GOV-11.3_A04 data and/or process owners assess whether required security, compliance and resilience controls for the Technology Assets, Applications, Services and/or Data (TAASD) under their control are implemented correctly. Assessment rigor: 1 Origin: SCF Created GOV-11.3_A05 data and/or process owners assess whether required security, compliance and resilience controls for the Technology Assets, Applications, Services and/or Data (TAASD) under their control are operating as intended. Assessment rigor: 1 Origin: SCF Created
GOV-11.4 Authorize Technology Assets, Applications and/or Services (TAAS) – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: GOV-11.4_A01 roles and responsibilities exist to compel data and/or process owners to obtain authorization for the production use of each Technology Asset, Application and/or Service (TAAS) under their control. Assessment rigor: 1 Origin: SCF Created GOV-11.4_A02 Individual Contributor (IC) performance reviews cover how data and/or process owners obtain authorization for the production use of each Technology Asset, Application and/or Service (TAAS) under their control. Defined parameters: at least annually Assessment rigor: 1 Origin: SCF Created
GOV-11.5 Monitor Controls – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: GOV-11.5_A01 roles and responsibilities exist to compel data and/or process owners to monitor the Technology Assets, Applications, Services and/or Data (TAASD) under their control on an ongoing basis for applicable threats and risks, and to confirm that security, compliance and resilience controls are operating as intended. Assessment rigor: 1 Origin: SCF Created GOV-11.5_A02 Individual Contributor (IC) performance reviews cover how data and/or process owners monitor the Technology Assets, Applications, Services and/or Data (TAASD) under their control on an ongoing basis for applicable threats and risks, and confirm that security, compliance and resilience controls are operating as intended. Defined parameters: at least annually Assessment rigor: 1 Origin: SCF Created
GOV-12 Measures of Performance – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: GOV-12_A01 cybersecurity / data privacy measures of performance are developed. Assessment rigor: 1 Origin: 53A_R5_PM-06[01] 53A_R5_PM-06[04] GOV-12_A02 cybersecurity / data privacy measures of performance are monitored. Assessment rigor: 1 Origin: 53A_R5_PM-06[02] 53A_R5_PM-06[05] GOV-12_A03 the results of cybersecurity / data privacy measures of performance are reported. Assessment rigor: 1 Origin: 53A_R5_PM-06[03] 53A_R5_PM-06[06]
GOV-12.1 Key Performance Indicators (KPIs) – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: GOV-12.1_A01 Key Performance Indicators (KPIs) are developed to assist organizational management in performance monitoring, trend analysis and possible control redesign or replacement for the organization's Security, Compliance & Resilience Program (SCRP). Defined parameters: at least quarterly Assessment rigor: 1 Origin: SCF Created GOV-12.1_A02 Key Performance Indicator (KPI) results are reported to organizational management per an organization-defined frequency. Defined parameters: at least quarterly Assessment rigor: 1 Origin: SCF Created GOV-12.1_A03 Key Performance Indicator (KPI) results are used to identify Security, Compliance & Resilience Program (SCRP) controls that may require redesign or replacement. Assessment rigor: 2 Origin: SCF Created
GOV-12.2 Key Risk Indicators (KRIs) – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: GOV-12.2_A01 Key Risk Indicators (KRIs) are developed to assist senior management in performance monitoring, trend analysis and possible control redesign or replacement for the organization's Security, Compliance & Resilience Program (SCRP). Defined parameters: at least quarterly Assessment rigor: 1 Origin: SCF Created GOV-12.2_A02 Key Risk Indicator (KRI) results are reported to senior management per an organization-defined frequency. Defined parameters: at least quarterly Assessment rigor: 1 Origin: SCF Created GOV-12.2_A03 Key Risk Indicator (KRI) results are used to identify Security, Compliance & Resilience Program (SCRP) controls that may require redesign or replacement. Assessment rigor: 2 Origin: SCF Created
GOV-13 Forced Technology Transfer (FTT) – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: GOV-13_A01 an executive steering committee, or advisory board, evaluates business practices for possible forced exfiltration of sensitive / regulated information (e.g., Intellectual Property (IP)) to a host government for purposes of market access or market management practices. Defined parameters: at least annually Assessment rigor: 1 Origin: SCF Created GOV-13_A02 documented measures enable the executive steering committee, or advisory board, to identify and evaluate host nation business practices that could result in the forced exfiltration of sensitive / regulated information (e.g., Intellectual Property (IP)) to the host government for purposes of market access or market management practices. Assessment rigor: 1 Origin: SCF Created GOV-13_A03 actions are taken to prevent and/or block potential instances that enable the forced exfiltration of sensitive / regulated information (e.g., Intellectual Property (IP)) to the host government for purposes of market access or market management practices. Assessment rigor: 1 Origin: SCF Created
GOV-14 State-Sponsored Espionage – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: GOV-14_A01 an executive steering committee, or advisory board, evaluates host nation business practices for possible instances where the organization's Technology Assets, Applications and/or Services (TAAS) could be leveraged for economic or political espionage and/or cyberwarfare activities. Defined parameters: at least annually Assessment rigor: 1 Origin: SCF Created GOV-14_A02 documented measures enable the executive steering committee, or advisory board, to identify and evaluate host nation business practices that could leverage the organization's Technology Assets, Applications and/or Services (TAAS) for economic or political espionage and/or cyberwarfare activities. Assessment rigor: 1 Origin: SCF Created GOV-14_A03 actions are taken to prevent and/or block potential instances where host nation business practices could leverage the organization's Technology Assets, Applications and/or Services (TAAS) for economic or political espionage and/or cyberwarfare activities. Assessment rigor: 1 Origin: SCF Created
GOV-15 Contacts With Authorities – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: GOV-15_A01 relevant law enforcement and/or regulatory bodies that necessitate communications are identified. Assessment rigor: 1 Origin: SCF Created GOV-15_A02 contacts with relevant law enforcement and/or regulatory bodies are established and documented. Defined parameters: at least annually Assessment rigor: 1 Origin: SCF Created
GOV-16 Contacts With Groups & Associations – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: GOV-16_A01 contact is established and institutionalized with selected groups and associations within the cybersecurity / data privacy community to facilitate ongoing security education and training for organizational personnel. Assessment rigor: 1 Origin: 53A_R5_PM-15a.[01] 53A_R5_PM-15a.[02] GOV-16_A02 contact is established and institutionalized with selected groups and associations within the cybersecurity / data privacy community to maintain currency with recommended security practices, techniques and technologies. Assessment rigor: 3 Origin: 53A_R5_PM-15b.[01] 53A_R5_PM-15b.[02] GOV-16_A03 contact is established and institutionalized with selected groups and associations within the cybersecurity / data privacy community to share current security information, including threats, vulnerabilities and incidents. Assessment rigor: 3 Origin: 53A_R5_PM-15c.[01] 53A_R5_PM-15c.[02]
GOV-17 Quality Management System (QMS) – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: GOV-17_A01 an implemented Quality Management System (QMS) governs the conformity of security, compliance and resilience processes with applicable statutory, regulatory and/or contractual obligations. Assessment rigor: 1 Origin: SCF Created
GOV-18 Assurance – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: GOV-18_A01 the basis for confidence that implemented capabilities conform to applicable security, compliance and resilience requirements is defined. Assessment rigor: 1 Origin: SCF Created
GOV-19 Mergers, Acquisitions & Divestitures (MA&D) – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: GOV-19_A01 standardized practices to conduct Mergers, Acquisitions and Divestiture (MA&D) activities are defined. Assessment rigor: 1 Origin: SCF Created
GOV-19.1 Virtual Data Room (VDR) – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: GOV-19.1_A01 a Virtual Data Room (VDR), or similar technology, is provisioned to securely share documentation among stakeholders to conduct Mergers, Acquisitions and Divestiture (MA&D) activities. Assessment rigor: 1 Origin: SCF Created
AAT-01 Artificial Intelligence & Autonomous Technologies Policy – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-01_A01 a formal, documented Artificial Intelligence and Autonomous Technologies (AAT) policy is approved by executive management, or a formally delegated authority, and conveys executive management's intent for Artificial Intelligence and Autonomous Technologies (AAT). Assessment rigor: 1 Origin: SCF Created AAT-01_A02 the Artificial Intelligence and Autonomous Technologies (AAT) policy provides organizational direction and states the behaviors expected of personnel and other applicable parties with respect to Artificial Intelligence and Autonomous Technologies (AAT). Assessment rigor: 1 Origin: SCF Created AAT-01_A03 the current version of the Artificial Intelligence and Autonomous Technologies (AAT) policy is communicated to, and accessible by, the personnel and other applicable parties who are expected to comply with it. Assessment rigor: 1 Origin: SCF Created AAT-01_A04 the Artificial Intelligence and Autonomous Technologies (AAT) policy is reviewed at least annually. Defined parameters: at least annually Assessment rigor: 1 Origin: SCF Created AAT-01_A05 the Artificial Intelligence and Autonomous Technologies (AAT) policy is updated, as necessary, in response to changes in risks, threats, business practices and/or statutory, regulatory and contractual obligations that affect the organization. Assessment rigor: 1 Origin: SCF Created
AAT-02 Artificial Intelligence (AI) & Autonomous Technologies Governance – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-02_A01 Artificial Intelligence (AI) and Autonomous Technologies (AAT)-specific policies, standards and procedures are developed and documented. Assessment rigor: 1 Origin: SCF Created AAT-02_A02 Artificial Intelligence (AI) and Autonomous Technologies (AAT)-specific policies, standards and procedures are implemented and operating as written. Assessment rigor: 1 Origin: SCF Created AAT-02_A03 Artificial Intelligence (AI) and Autonomous Technologies (AAT) operations are conducted according to documented policies, standards, procedures and/or other organizational directives. Assessment rigor: 1 Origin: SCF Created AAT-02_A04 documented resourcing decisions allocate the people, processes, technologies, data and facilities needed to support Artificial Intelligence (AI) and Autonomous Technologies (AAT) operations. Assessment rigor: 1 Origin: SCF Created AAT-02_A05 responsibility and authority for the performance of Artificial Intelligence (AI) and Autonomous Technologies (AAT)-related activities are assigned to designated personnel. Assessment rigor: 1 Origin: SCF Created AAT-02_A06 personnel performing Artificial Intelligence (AI) and Autonomous Technologies (AAT)-related activities have the skills and knowledge needed to perform their assigned duties. Assessment rigor: 2 Origin: SCF Created
AAT-03 AI & Autonomous Technologies Mission and Goals Definition – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-03_A01 the mission for Artificial Intelligence (AI) and Autonomous Technologies (AAT) is documented. Assessment rigor: 1 Origin: SCF Created AAT-03_A02 the relevant goals for Artificial Intelligence (AI) and Autonomous Technologies (AAT) are documented. Assessment rigor: 1 Origin: SCF Created
AAT-03.1 AI & Autonomous Technologies Value Sustainment – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-03.1_A01 the organization analyzes its business practices to identify opportunities to sustain the value of deployed Artificial Intelligence (AI) and Autonomous Technologies (AAT). Assessment rigor: 1 Origin: SCF Created AAT-03.1_A02 the organization implements documented improvements to its business practices, per an organization-defined frequency, to sustain the value of deployed Artificial Intelligence (AI) and Autonomous Technologies (AAT). Defined parameters: at least annually Assessment rigor: 1 Origin: SCF Created
AAT-04 AI & Autonomous Technologies Context Definition – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-04_A01 the context for the intended purpose(s) for Artificial Intelligence (AI) and Autonomous Technologies (AAT) is documented. Assessment rigor: 1 Origin: SCF Created AAT-04_A02 the context for the potentially beneficial use(s) for Artificial Intelligence (AI) and Autonomous Technologies (AAT) is documented. Assessment rigor: 1 Origin: SCF Created AAT-04_A03 the context for legal and regulatory compliance for Artificial Intelligence (AI) and Autonomous Technologies (AAT) is documented. Assessment rigor: 1 Origin: SCF Created AAT-04_A04 the context for the norms and expectations for Artificial Intelligence (AI) and Autonomous Technologies (AAT) is documented. Assessment rigor: 1 Origin: SCF Created AAT-04_A05 the context for the proposed deployment setting(s) for Artificial Intelligence (AI) and Autonomous Technologies (AAT) is documented. Assessment rigor: 1 Origin: SCF Created
AAT-04.1 AI & Autonomous Technologies-Related Legal Requirements Identification – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-04.1_A01 the organization analyzes its business practices to determine applicable statutory, regulatory and/or contractual obligations for Artificial Intelligence (AI) and Autonomous Technologies (AAT). Defined parameters: at least annually Assessment rigor: 1 Origin: SCF Created
AAT-05 Assigned Responsibilities for AI & Autonomous Technologies – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-05_A01 cybersecurity / data privacy roles and responsibilities are incorporated into organizational position descriptions. Assessment rigor: 1 Origin: 53A_R5_PS-09[01] 53A_R5_PS-09[02] AAT-05_A02 users are formally made aware of their defined roles and responsibilities for Artificial Intelligence (AI) and Autonomous Technologies (AAT) configurations and for oversight of AAT systems. Assessment rigor: 1 Origin: SCF Created AAT-05_A03 records of user acknowledgement of Artificial Intelligence (AI) and Autonomous Technologies (AAT) roles and responsibilities are retained by the organization. Defined parameters: retained for at least the current and the preceding acknowledgement cycle Assessment rigor: 1 Origin: SCF Created AAT-05_A04 the frequency at which to review / update position risk designations is defined. Defined parameters: at least annually Assessment rigor: 1 Origin: 53A_R5_PS-02_ODP AAT-05_A05 a risk designation is assigned to all organizational positions. Assessment rigor: 1 Origin: 53A_R5_PS-02a.
AAT-06 Trustworthy AI & Autonomous Technologies – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-06_A01 secure engineering principles are defined. Assessment rigor: 1 Origin: 53A_R5_SA-08_ODP[01] AAT-06_A02 privacy engineering principles are defined. Assessment rigor: 1 Origin: 53A_R5_SA-08_ODP[02]
AAT-06.1 AI & Autonomous Technologies Continuous Improvements – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-06.1_A01 a documented strategy exists to continuously monitor Artificial Intelligence (AI) and Autonomous Technologies (AAT) in order to maximize benefits while minimizing negative impacts. Assessment rigor: 1 Origin: SCF Created
AAT-07 Situational Awareness of AI & Autonomous Technologies In Use – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-07_A01 an inventory of systems and system components that is at the level of granularity deemed necessary for tracking and reporting is documented. Assessment rigor: 1 Origin: 53A_R5_CM-08a.04
AAT-07.1 AI Model & Agent Inventory & Lifecycle Management – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-07.1_A01 the organization tracks AI models and AI agents deployed in development environments, capturing: (1) ownership; (2) intended purpose; and (3) status. Assessment rigor: 1 Origin: SCF Created AAT-07.1_A02 the organization tracks AI models and AI agents deployed in production environments, capturing: (1) ownership; (2) intended purpose; and (3) status. Assessment rigor: 1 Origin: SCF Created AAT-07.1_A03 the organization tracks updates to AI models and AI agents, capturing: (1) ownership; (2) intended purpose; and (3) status. Assessment rigor: 1 Origin: SCF Created AAT-07.1_A04 the organization tracks decommissioned AI models and AI agents, capturing: (1) ownership; (2) intended purpose; and (3) date of decommissioning. Assessment rigor: 1 Origin: SCF Created
AAT-07.2 Artificial Intelligence and Autonomous Technologies (AAT) & AI Agent Categorization – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-07.2_A01 defined classes are assigned to Artificial Intelligence and Autonomous Technologies (AAT) and AI agents based on their characteristics (e.g., intended use, autonomy, access, potential impact and risk). Assessment rigor: 1 Origin: SCF Created AAT-07.2_A02 the assigned class determines applicable approval requirements. Assessment rigor: 1 Origin: SCF Created AAT-07.2_A03 the assigned class determines applicable security, compliance and/or resilience controls. Assessment rigor: 1 Origin: SCF Created AAT-07.2_A04 the assigned class determines applicable testing rigor. Assessment rigor: 1 Origin: SCF Created AAT-07.2_A05 the assigned class determines applicable monitoring requirements. Assessment rigor: 1 Origin: SCF Created AAT-07.2_A06 the assigned class determines applicable supporting documentation. Assessment rigor: 1 Origin: SCF Created AAT-07.2_A07 the assigned class determines applicable oversight requirements. Assessment rigor: 1 Origin: SCF Created
AAT-08 AI & Autonomous Technologies Internal Controls – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-08_A01 roles and responsibilities exist to compel data and/or process owners to select required cybersecurity / data privacy controls for Artificial Intelligence (AI) and Autonomous Technologies (AAT) under their control. Assessment rigor: 1 Origin: SCF Created AAT-08_A02 Individual Contributor (IC) performance reviews cover how data and/or process owners operationalized cybersecurity / data privacy practices for Artificial Intelligence (AI) and Autonomous Technologies (AAT) under their control. Assessment rigor: 1 Origin: SCF Created
AAT-08.1 Adequate Protections For AI & Autonomous Technologies – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-08.1_A01 risks and threats for Artificial Intelligence (AI) and Autonomous Technologies (AAT) are identified. Assessment rigor: 1 Origin: SCF Created AAT-08.1_A02 cybersecurity and data protections for Artificial Intelligence (AI) and Autonomous Technologies (AAT) are defined and are commensurate with assessed risks and threats. Assessment rigor: 1 Origin: SCF Created AAT-08.1_A03 cybersecurity and data protections for Artificial Intelligence (AI) and Autonomous Technologies (AAT) are implemented and are commensurate with assessed risks and threats. Assessment rigor: 1 Origin: SCF Created
AAT-09 AI & Autonomous Technologies Impact Assessment – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-09_A01 the organization characterizes the impacts of proposed Artificial Intelligence (AI) and Autonomous Technologies (AAT) on individuals. Assessment rigor: 1 Origin: SCF Created AAT-09_A02 the organization characterizes the impact of proposed Artificial Intelligence (AI) and Autonomous Technologies (AAT) on groups. Assessment rigor: 1 Origin: SCF Created AAT-09_A03 the organization characterizes the impact of proposed Artificial Intelligence (AI) and Autonomous Technologies (AAT) on communities. Assessment rigor: 1 Origin: SCF Created AAT-09_A04 the organization characterizes the impact of proposed Artificial Intelligence (AI) and Autonomous Technologies (AAT) on organizations. Assessment rigor: 1 Origin: SCF Created AAT-09_A05 the organization characterizes the impact of proposed Artificial Intelligence (AI) and Autonomous Technologies (AAT) on society. Assessment rigor: 1 Origin: SCF Created
AAT-10 AI & Autonomous Technologies Risk Profiling – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-10_A01 a risk catalog of Artificial Intelligence (AI) and Autonomous Technologies (AAT)-specific risks is documented. Assessment rigor: 1 Origin: SCF Created AAT-10_A02 the organization maps its risk catalog, including potential impacts, to instances where Artificial Intelligence (AI) and Autonomous Technologies (AAT) are designed, developed, deployed, evaluated and used. Assessment rigor: 1 Origin: SCF Created
AAT-10.1 AI & Autonomous Technologies Risk Mapping – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-10.1_A01 a risk catalog of Artificial Intelligence (AI) and Autonomous Technologies (AAT)-specific risks is documented. Assessment rigor: 1 Origin: SCF Created AAT-10.1_A02 a compliance catalog of Artificial Intelligence (AI) and Autonomous Technologies (AAT)-specific laws, regulations and contractual obligations is documented. Assessment rigor: 1 Origin: SCF Created AAT-10.1_A03 the organization maps its risk catalog to its compliance catalog for Artificial Intelligence (AI) and Autonomous Technologies (AAT). Assessment rigor: 1 Origin: SCF Created
AAT-11 AI & Autonomous Technologies Risk Management Decisions – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-11_A01 the organization leverages decision makers from a diversity of backgrounds for mapping, measuring and managing Artificial Intelligence (AI) and Autonomous Technologies (AAT)-related risks (e.g., demographics, disciplines, experience and expertise). Assessment rigor: 1 Origin: SCF Created
AAT-11.1 AI & Autonomous Technologies Likelihood & Impact Risk Analysis – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-11.1_A01 the potential likelihood is documented for each identified risk based on expected use and past uses of Artificial Intelligence (AI) and Autonomous Technologies (AAT) in similar contexts. Assessment rigor: 1 Origin: SCF Created AAT-11.1_A02 the potential impact is documented for each identified risk based on expected use and past uses of Artificial Intelligence (AI) and Autonomous Technologies (AAT) in similar contexts. Assessment rigor: 1 Origin: SCF Created
AAT-11.2 AI & Autonomous Technologies High Risk Designations – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-11.2_A01 Artificial Intelligence (AI) and Autonomous Technologies (AAT) are assessed for risk to determine whether the criteria for a "High Risk" designation are met. Assessment rigor: 1 Origin: SCF Created AAT-11.2_A02 Artificial Intelligence (AI) and Autonomous Technologies (AAT) are designated as "High Risk" if one (1), or more, of the following criteria are met: (1) AAT is used as a safety component of a product or service; (2) AAT poses a significant risk of harm to an individual's health, safety or fundamental rights; and/or (3) AAT materially influences the outcome of an individual's decision making. Assessment rigor: 1 Origin: SCF Created
AAT-12 AI Threat Modeling & Risk Assessment – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-12_A01 Artificial Intelligence (AI) and Autonomous Technologies (AAT)-specific threat modeling addresses the following criteria across the lifecycle of the AAT: (1) Attack surfaces; (2) Adversarial threats; and (3) Abuse / misuse scenarios. Defined parameters: at least annually; and upon any significant change to the AAT, its data or its intended use Assessment rigor: 1 Origin: SCF Created AAT-12_A02 Artificial Intelligence (AI) and Autonomous Technologies (AAT)-specific risk assessments address the following criteria across the lifecycle of the AAT: (1) Attack surfaces; (2) Adversarial threats; and (3) Abuse / misuse scenarios. Defined parameters: at least annually; and upon any significant change to the AAT, its data or its intended use Assessment rigor: 1 Origin: SCF Created
AAT-12.1 Novel Risk Assessment Methods & Technologies – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-12.1_A01 novel methods and technologies for the measurement of Artificial Intelligence (AI) and Autonomous Technologies (AAT)-related risks are defined. Assessment rigor: 1 Origin: SCF Created AAT-12.1_A02 novel methods and technologies for the measurement of Artificial Intelligence (AI) and Autonomous Technologies (AAT)-related risks are utilized to evaluate content provenance. Assessment rigor: 1 Origin: SCF Created AAT-12.1_A03 novel methods and technologies for the measurement of Artificial Intelligence (AI) and Autonomous Technologies (AAT)-related risks are utilized to evaluate offensive cyber capabilities. Assessment rigor: 1 Origin: SCF Created AAT-12.1_A04 novel methods and technologies for the measurement of Artificial Intelligence (AI) and Autonomous Technologies (AAT)-related risks are utilized to evaluate Chemical, Biological, Radiological or Nuclear (CBRN) weapons. Assessment rigor: 1 Origin: SCF Created AAT-12.1_A05 novel methods and technologies for the measurement of Artificial Intelligence (AI) and Autonomous Technologies (AAT)-related risks are utilized to evaluate other dangerous materials or agents. Assessment rigor: 1 Origin: SCF Created
AAT-13 AI & Autonomous Technologies Risk Response – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-13_A01 responsible parties prioritize Artificial Intelligence (AI) and Autonomous Technologies (AAT)-related risks based on assessments and other analytical output. Assessment rigor: 1 Origin: SCF Created
AAT-13.1 AI & Autonomous Technologies Risk Tracking Approaches – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-13.1_A01 an executive steering committee, or advisory board, tracks Artificial Intelligence (AI) and Autonomous Technologies (AAT)-related risks that are difficult to assess using currently available measurement techniques or where metrics are not yet available. Assessment rigor: 1 Origin: SCF Created
AAT-13.2 Fine Tuning Risk Mitigation – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-13.2_A01 actions to fine-tune Artificial Intelligence (AI) and Autonomous Technologies (AAT) that do not compromise existing security, compliance and resilience controls are defined. Assessment rigor: 1 Origin: SCF Created AAT-13.2_A02 actions to fine-tune Artificial Intelligence (AI) and Autonomous Technologies (AAT) do not compromise existing security, compliance and resilience controls. Assessment rigor: 1 Origin: SCF Created
AAT-13.3 Responsibility To Supersede, Deactivate and/or Disengage AI & Autonomous Technologies – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-13.3_A01 an executive steering committee, or advisory board, defines criteria for superseding, disengaging or deactivating Artificial Intelligence (AI) and Autonomous Technologies (AAT). Assessment rigor: 1 Origin: SCF Created AAT-13.3_A02 an executive steering committee, or advisory board, assigns named party(ies) the responsibility for superseding, disengaging or deactivating Artificial Intelligence (AI) and Autonomous Technologies (AAT) when designated criteria are demonstrated. Assessment rigor: 1 Origin: SCF Created
AAT-14 AI & Autonomous Technologies Business Case – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-14_A01 capabilities for Artificial Intelligence (AI) and Autonomous Technologies (AAT) are benchmarked. Defined parameters: at least annually Assessment rigor: 1 Origin: SCF Created AAT-14_A02 targeted usage for Artificial Intelligence (AI) and Autonomous Technologies (AAT) is benchmarked. Defined parameters: at least annually Assessment rigor: 1 Origin: SCF Created AAT-14_A03 goals for Artificial Intelligence (AI) and Autonomous Technologies (AAT) are benchmarked. Defined parameters: at least annually Assessment rigor: 1 Origin: SCF Created AAT-14_A04 expected benefits for Artificial Intelligence (AI) and Autonomous Technologies (AAT) are benchmarked. Defined parameters: at least annually Assessment rigor: 1 Origin: SCF Created AAT-14_A05 expected costs for Artificial Intelligence (AI) and Autonomous Technologies (AAT) are benchmarked. Defined parameters: at least annually Assessment rigor: 1 Origin: SCF Created
AAT-14.1 AI & Autonomous Technologies Potential Benefits Analysis – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-14.1_A01 documented methods exist to assess the potential benefits of Artificial Intelligence (AI) and Autonomous Technologies (AAT). Assessment rigor: 1 Origin: SCF Created
AAT-14.2 AI & Autonomous Technologies Potential Costs Analysis – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-14.2_A01 documented methods exist to assess the potential costs, including non-monetary costs, resulting from expected or realized Artificial Intelligence (AI) and Autonomous Technologies (AAT)-related errors or system functionality and trustworthiness. Assessment rigor: 1 Origin: SCF Created
AAT-14.3 AI & Autonomous Technologies Targeted Application Scope – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-14.3_A01 the targeted application scope of the proposed use and operation of Artificial Intelligence (AI) and Autonomous Technologies (AAT) is defined and documented. Assessment rigor: 1 Origin: SCF Created
AAT-14.4 AI & Autonomous Technologies Cost / Benefit Mapping – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-14.4_A01 a risk catalog of Artificial Intelligence (AI) and Autonomous Technologies (AAT)-specific risks is documented. Assessment rigor: 1 Origin: SCF Created AAT-14.4_A02 a compliance catalog of Artificial Intelligence (AI) and Autonomous Technologies (AAT)-specific laws, regulations and contractual obligations is documented. Assessment rigor: 1 Origin: SCF Created AAT-14.4_A03 a Third-Party Service Provider (TSP) catalog that includes Software as a Service (SaaS) is documented. Assessment rigor: 1 Origin: SCF Created AAT-14.4_A04 the organization maps its risk catalog across its compliance and Third-Party Service Provider (TSP) catalogs for Artificial Intelligence (AI) and Autonomous Technologies (AAT) to determine the scope and potential impact of AAT-related risks. Assessment rigor: 1 Origin: SCF Created
AAT-15 Model & AI Agent Documentation – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-15_A01 AI model and agent-related documentation artifacts for data lineage are created, maintained and accessible. Defined parameters: at least annually Assessment rigor: 1 Origin: SCF Created AAT-15_A02 AI model and agent-related documentation artifacts for intended use are created, maintained and accessible. Defined parameters: at least annually Assessment rigor: 1 Origin: SCF Created AAT-15_A03 AI model and agent-related documentation artifacts for limitations are created, maintained and accessible. Defined parameters: at least annually Assessment rigor: 1 Origin: SCF Created
AAT-16 AI & Autonomous Technologies Output Marking – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-16_A01 Artificial Intelligence (AI) and Autonomous Technologies (AAT) output is marked in a machine-readable format so it is detectable as artificially generated or manipulated. Assessment rigor: 1 Origin: SCF Created
AAT-17 Release Owner Gate (ROG) For AI-Augmented Content – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-17_A01 a Release Owner Gate (ROG), or similar function, prohibits the external release of AI-augmented content without formal Subject Matter Expert (SME) review and Line of Business (LOB) approval. Assessment rigor: 1 Origin: SCF Created AAT-17_A02 the review and approval process validates material facts. Assessment rigor: 1 Origin: SCF Created AAT-17_A03 the review and approval process validates citations. Assessment rigor: 1 Origin: SCF Created AAT-17_A04 the review and approval process validates other relevant content that could discredit the organization. Assessment rigor: 1 Origin: SCF Created
AAT-17.1 AI & Autonomous Technologies Output Filtering – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-17.1_A01 Artificial Intelligence (AI) and Autonomous Technologies (AAT) are prevented from generating content that is prohibited as inappropriate by organization-defined content standards. Assessment rigor: 1 Origin: SCF Created AAT-17.1_A02 Artificial Intelligence (AI) and Autonomous Technologies (AAT) are prevented from generating content that is harmful. Assessment rigor: 1 Origin: SCF Created AAT-17.1_A03 Artificial Intelligence (AI) and Autonomous Technologies (AAT) are prevented from generating content that is false. Assessment rigor: 1 Origin: SCF Created AAT-17.1_A04 Artificial Intelligence (AI) and Autonomous Technologies (AAT) are prevented from generating content that is illegal. Assessment rigor: 1 Origin: SCF Created AAT-17.1_A05 Artificial Intelligence (AI) and Autonomous Technologies (AAT) are prevented from generating content that is violent. Assessment rigor: 1 Origin: SCF Created
AAT-17.2 Human Moderation of AI & Autonomous Technologies-Generated Content – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-17.2_A01 personnel are assigned responsibility to review Artificial Intelligence (AI) and Autonomous Technologies (AAT)-generated content for alignment with culturally accepted norms. Assessment rigor: 1 Origin: SCF Created
AAT-18 AI & Autonomous Technologies Intellectual Property Infringement Protections – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-18_A01 an executive steering committee, or advisory board, evaluates business processes that use, or are proposed to use, Artificial Intelligence (AI) and Autonomous Technologies (AAT). Assessment rigor: 1 Origin: SCF Created AAT-18_A02 measures exist for the executive steering committee, or advisory board, to proactively identify and evaluate third-party Intellectual Property (IP) infringement risks from Artificial Intelligence (AI) and Autonomous Technologies (AAT) usage. Assessment rigor: 1 Origin: SCF Created AAT-18_A03 actions are taken to prevent and/or block Artificial Intelligence (AI) and Autonomous Technologies (AAT) capabilities that infringe upon another party's Intellectual Property (IP). Assessment rigor: 1 Origin: SCF Created
AAT-18.1 Data Source Identification – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-18.1_A01 data sources utilized in the training and/or operation of Artificial Intelligence and Autonomous Technologies (AAT) are documented. Defined parameters: at least annually Assessment rigor: 1 Origin: SCF Created
AAT-18.2 Data Source Integrity – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-18.2_A01 sources of data used by Artificial Intelligence and Autonomous Technologies (AAT) are evaluated for susceptibility to compromise. Defined parameters: at least annually Assessment rigor: 1 Origin: SCF Created AAT-18.2_A02 methods to protect integrity of source data to prevent accidental contamination or malicious corruption (e.g., data poisoning) that could compromise the performance of Artificial Intelligence and Autonomous Technologies (AAT) are implemented. Assessment rigor: 1 Origin: SCF Created
AAT-18.3 Data Source Lineage & Origin Disclosure – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-18.3_A01 the organization publicly discloses information about Artificial Intelligence and Autonomous Technologies (AAT) in detail that enables content lineage to be assessed. Assessment rigor: 1 Origin: SCF Created AAT-18.3_A02 the organization publicly discloses information about Artificial Intelligence and Autonomous Technologies (AAT) in detail that enables any transforms or modification of the data used for the output to be assessed. Assessment rigor: 1 Origin: SCF Created
AAT-18.4 Digital Content Modification Logging – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-18.4_A01 Artificial Intelligence and Autonomous Technologies (AAT) are configured to enable auditing of content modifications. Assessment rigor: 1 Origin: SCF Created AAT-18.4_A02 Artificial Intelligence and Autonomous Technologies (AAT) are configured to generate event logs for content-related changes. Assessment rigor: 1 Origin: SCF Created
AAT-18.5 Training Data Source & Integrity – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-18.5_A01 the reliability, accuracy and integrity of training data used by Artificial Intelligence and Autonomous Technologies (AAT) are validated. Assessment rigor: 1 Origin: SCF Created
AAT-18.6 Prohibit Training – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-18.6_A01 Artificial Intelligence and Autonomous Technologies (AAT) are prohibited from training, fine-tuning and/or improving capabilities using organizational data without prior, explicit consent from applicable data owner(s). Assessment rigor: 1 Origin: SCF Created
AAT-19 AI & Autonomous Technologies Harm Prevention – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-19_A01 the organization proactively identifies unanticipated and emergent Artificial Intelligence (AI) and Autonomous Technologies (AAT)-related risks per an organization-defined frequency. Defined parameters: at least quarterly Assessment rigor: 1 Origin: SCF Created AAT-19_A02 the organization tracks existing, unanticipated and emergent Artificial Intelligence (AI) and Autonomous Technologies (AAT)-related risks in a Plan of Action & Milestones (POA&M), or similar risk register. Assessment rigor: 1 Origin: SCF Created
AAT-19.1 AI & Autonomous Technologies Human Subject Protections – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-19.1_A01 an executive steering committee, or advisory board, evaluates business practices that could pose harm to human subjects from Artificial Intelligence (AI) and Autonomous Technologies (AAT). Assessment rigor: 1 Origin: SCF Created AAT-19.1_A02 safeguards directed by the executive steering committee, or advisory board, are implemented to protect human subjects from harm due to Artificial Intelligence (AI) and Autonomous Technologies (AAT). Assessment rigor: 1 Origin: SCF Created
AAT-19.2 AI & Autonomous Technologies Environmental Impact & Sustainability – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-19.2_A01 an executive steering committee, or advisory board, documents its evaluation of the environmental impacts of Artificial Intelligence (AI) and Autonomous Technologies (AAT). Assessment rigor: 1 Origin: SCF Created AAT-19.2_A02 an executive steering committee, or advisory board, documents its evaluation of the sustainability of Artificial Intelligence (AI) and Autonomous Technologies (AAT). Assessment rigor: 1 Origin: SCF Created
AAT-19.3 Previously Unknown AI & Autonomous Technologies Threats & Risks – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-19.3_A01 an incident response capability exists to respond to previously unknown Artificial Intelligence (AI) and Autonomous Technologies (AAT)-related risks when they are identified. Assessment rigor: 1 Origin: SCF Created
AAT-20 AI & Autonomous Technologies Conformity – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-20_A01 the organization defines use cases for Artificial Intelligence (AI) and Autonomous Technologies (AAT). Assessment rigor: 1 Origin: SCF Created AAT-20_A02 the organization defines geographic markets for Artificial Intelligence (AI) and Autonomous Technologies (AAT). Assessment rigor: 1 Origin: SCF Created AAT-20_A03 the organization defines the use of Intellectual Property (IP) for Artificial Intelligence (AI) and Autonomous Technologies (AAT). Assessment rigor: 1 Origin: SCF Created AAT-20_A04 deployed Artificial Intelligence (AI) and Autonomous Technologies (AAT) conform to applicable statutory and regulatory requirements, based on defined use cases. Assessment rigor: 1 Origin: SCF Created AAT-20_A05 deployed Artificial Intelligence (AI) and Autonomous Technologies (AAT) conform to applicable statutory and regulatory requirements, based on geographic markets. Assessment rigor: 1 Origin: SCF Created AAT-20_A06 deployed Artificial Intelligence (AI) and Autonomous Technologies (AAT) conform to applicable statutory and regulatory requirements, based on the use of Intellectual Property (IP). Assessment rigor: 1 Origin: SCF Created
AAT-20.1 Manipulative or Deceptive Techniques – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-20.1_A01 the organization defines manipulative or deceptive techniques that Artificial Intelligence (AI) and Autonomous Technologies (AAT) could use to impair an individual's ability to make a reasonably informed decision. Assessment rigor: 1 Origin: SCF Created AAT-20.1_A02 the organization prohibits the sale, deployment and/or use of Artificial Intelligence (AI) and Autonomous Technologies (AAT) that utilizes manipulative or deceptive techniques (including biased data) to impair an individual's ability to make a reasonably informed decision. Assessment rigor: 1 Origin: SCF Created
AAT-20.2 Materially Distorting Behaviors – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-20.2_A01 the organization prohibits the sale, deployment and/or use of Artificial Intelligence (AI) and Autonomous Technologies (AAT) that exploits a human subject to materially affect a targeted behavior due to their age. Assessment rigor: 1 Origin: SCF Created AAT-20.2_A02 the organization prohibits the sale, deployment and/or use of Artificial Intelligence (AI) and Autonomous Technologies (AAT) that exploits a human subject to materially affect a targeted behavior due to their disability. Assessment rigor: 1 Origin: SCF Created AAT-20.2_A03 the organization prohibits the sale, deployment and/or use of Artificial Intelligence (AI) and Autonomous Technologies (AAT) that exploits a human subject to materially affect a targeted behavior due to their specific social or economic situation. Assessment rigor: 1 Origin: SCF Created
AAT-20.3 Social Scoring – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-20.3_A01 the organization prohibits the sale, deployment and/or use of Artificial Intelligence (AI) and Autonomous Technologies (AAT) that evaluate human subjects over a certain period of time based on their social behavior or known, inferred or predicted personal or personality characteristics. Assessment rigor: 1 Origin: SCF Created AAT-20.3_A02 the organization prohibits the sale, deployment and/or use of Artificial Intelligence (AI) and Autonomous Technologies (AAT) that assign a "social score" branding or equivalent classification. Assessment rigor: 1 Origin: SCF Created
AAT-20.4 Detrimental or Unfavorable Treatment – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-20.4_A01 the organization prohibits the sale, deployment and/or use of Artificial Intelligence (AI) and Autonomous Technologies (AAT) that lead to the detrimental or unfavorable treatment of certain data subjects, or groups of data subjects, in social contexts that are unrelated to the contexts in which the data was originally generated or collected. Assessment rigor: 1 Origin: SCF Created AAT-20.4_A02 the organization prohibits the sale, deployment and/or use of Artificial Intelligence (AI) and Autonomous Technologies (AAT) that lead to the detrimental or unfavorable treatment of certain data subjects, or groups of data subjects, in social contexts that are unjustified or disproportionate to their social behavior or its gravity. Assessment rigor: 1 Origin: SCF Created
AAT-20.5 Risk and Criminal Profiling – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-20.5_A01 the organization prohibits the sale, deployment and/or use of Artificial Intelligence (AI) and Autonomous Technologies (AAT) that assess the risk of an individual committing a criminal offence. Assessment rigor: 1 Origin: SCF Created AAT-20.5_A02 the organization prohibits the sale, deployment and/or use of Artificial Intelligence (AI) and Autonomous Technologies (AAT) that predict risk based solely on the profiling of personality traits and characteristics. Assessment rigor: 1 Origin: SCF Created
AAT-20.6 Populating Facial Recognition Databases – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-20.6_A01 the organization prohibits the sale, deployment and/or use of Artificial Intelligence (AI) and Autonomous Technologies (AAT) that create, or expand, facial recognition databases through scraping facial images from the Internet. Assessment rigor: 1 Origin: SCF Created AAT-20.6_A02 the organization prohibits the sale, deployment and/or use of Artificial Intelligence (AI) and Autonomous Technologies (AAT) that create, or expand, facial recognition databases through scraping facial images from Closed-Circuit Television (CCTV) footage. Assessment rigor: 1 Origin: SCF Created
AAT-20.7 Emotion Inference – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-20.7_A01 the organization prohibits the sale, deployment and/or use of Artificial Intelligence (AI) and Autonomous Technologies (AAT) that infer human emotions of an individual based on observed characteristics. Assessment rigor: 1 Origin: SCF Created
AAT-20.8 Biometric Categorization – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-20.8_A01 the organization prohibits the sale, deployment and/or use of Artificial Intelligence (AI) and Autonomous Technologies (AAT) that categorize an individual based on their biometric data to deduce, or infer, the individual's race. Assessment rigor: 1 Origin: SCF Created AAT-20.8_A02 the organization prohibits the sale, deployment and/or use of Artificial Intelligence (AI) and Autonomous Technologies (AAT) that categorize an individual based on their biometric data to deduce, or infer, the individual's political opinions. Assessment rigor: 1 Origin: SCF Created AAT-20.8_A03 the organization prohibits the sale, deployment and/or use of Artificial Intelligence (AI) and Autonomous Technologies (AAT) that categorize an individual based on their biometric data to deduce, or infer, the individual's trade union membership. Assessment rigor: 1 Origin: SCF Created AAT-20.8_A04 the organization prohibits the sale, deployment and/or use of Artificial Intelligence (AI) and Autonomous Technologies (AAT) that categorize an individual based on their biometric data to deduce, or infer, the individual's religious or philosophical beliefs. Assessment rigor: 1 Origin: SCF Created AAT-20.8_A05 the organization prohibits the sale, deployment and/or use of Artificial Intelligence (AI) and Autonomous Technologies (AAT) that categorize an individual based on their biometric data to deduce, or infer, the individual's sex life or sexual orientation. Assessment rigor: 1 Origin: SCF Created AAT-20.8_A06 the organization prohibits the sale, deployment and/or use of Artificial Intelligence (AI) and Autonomous Technologies (AAT) that categorize an individual based on their biometric data to deduce, or infer, the individual's age. Assessment rigor: 1 Origin: SCF Created
AAT-21 AI & Autonomous Technologies Requirements Definitions – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-21_A01 the organization documents how socio-technical implications are taken into account when addressing risks associated with Artificial Intelligence (AI) and Autonomous Technologies (AAT). Assessment rigor: 1 Origin: SCF Created
AAT-22 AI & Autonomous Technologies Fairness & Bias – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-22_A01 a documented methodology prioritizes workforce diversity, equity, inclusion and accessibility processes in the mapping, measuring and managing of Artificial Intelligence (AI) and Autonomous Technologies (AAT)-related risks throughout the AAT lifecycle. Assessment rigor: 1 Origin: SCF Created AAT-22_A02 Artificial Intelligence (AI) and Autonomous Technologies (AAT) are tested for outputs that unfairly identify, profile and/or statistically single out a segmented population defined by race, religion, gender identity, national origin, disability or any other politically-charged identifier, and identified issues are remediated. Assessment rigor: 2 Origin: SCF Created
AAT-23 AI & Autonomous Technologies Knowledge Limits – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-23_A01 the knowledge limits of Artificial Intelligence (AI) and Autonomous Technologies (AAT) are identified and documented. Assessment rigor: 1 Origin: SCF Created AAT-23_A02 stakeholders are provided the knowledge limits of Artificial Intelligence (AI) and Autonomous Technologies (AAT) to assist in decision making. Assessment rigor: 1 Origin: SCF Created
AAT-24 AI & Autonomous Technologies Development Practices – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-24_A01 Artificial Intelligence (AI) and Autonomous Technologies (AAT) are designed and developed to achieve organization-defined levels of accuracy, resilience and cybersecurity. Assessment rigor: 1 Origin: SCF Created AAT-24_A02 Artificial Intelligence (AI) and Autonomous Technologies (AAT) are designed and developed to perform consistently with respect to accuracy, resilience and cybersecurity throughout the AAT system's lifecycle. Assessment rigor: 1 Origin: SCF Created AAT-24_A03 Artificial Intelligence (AI) and Autonomous Technologies (AAT) are designed and developed to include capabilities that enable oversight by competent individuals. Assessment rigor: 1 Origin: SCF Created
AAT-24.1 AI & Autonomous Technologies Transparency – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-24.1_A01 Artificial Intelligence (AI) and Autonomous Technologies (AAT) are designed and developed so that their operation is transparent to the extent that personnel implementing the AAT can interpret AAT output. Assessment rigor: 1 Origin: SCF Created
AAT-24.2 AI & Autonomous Technologies Implementation Documentation – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-24.2_A01 Artificial Intelligence (AI) and Autonomous Technologies (AAT) supporting documentation contains contact details of the provider. Assessment rigor: 1 Origin: SCF Created AAT-24.2_A02 Artificial Intelligence (AI) and Autonomous Technologies (AAT) supporting documentation contains characteristics, capabilities and limitations of performance of the AAT. Assessment rigor: 1 Origin: SCF Created AAT-24.2_A03 Artificial Intelligence (AI) and Autonomous Technologies (AAT) supporting documentation contains errata from the AAT's initial conformity assessment. Assessment rigor: 1 Origin: SCF Created AAT-24.2_A04 Artificial Intelligence (AI) and Autonomous Technologies (AAT) supporting documentation contains details necessary to interpret the outputs of the AAT. Assessment rigor: 1 Origin: SCF Created AAT-24.2_A05 Artificial Intelligence (AI) and Autonomous Technologies (AAT) supporting documentation contains human oversight measures necessary to facilitate the interpretation of the outputs of the AAT. Assessment rigor: 1 Origin: SCF Created AAT-24.2_A06 Artificial Intelligence (AI) and Autonomous Technologies (AAT) supporting documentation contains computational and hardware resources needed to operate the AAT. Assessment rigor: 1 Origin: SCF Created AAT-24.2_A07 Artificial Intelligence (AI) and Autonomous Technologies (AAT) supporting documentation contains projected useable lifetime of the AAT. Assessment rigor: 1 Origin: SCF Created AAT-24.2_A08 Artificial Intelligence (AI) and Autonomous Technologies (AAT) supporting documentation contains a description of the mechanisms included within the AAT system to collect, store and interpret event logs. Assessment rigor: 1 Origin: SCF Created
AAT-24.3 AI & Autonomous Technologies Human Domain Knowledge Reliance – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-24.3_A01 documentation covering the extent to which human domain knowledge is employed to improve Artificial Intelligence (AI) and Autonomous Technologies (AAT) performance includes Reinforcement Learning from Human Feedback (RLHF). Assessment rigor: 1 Origin: SCF Created AAT-24.3_A02 documentation covering the extent to which human domain knowledge is employed to improve Artificial Intelligence (AI) and Autonomous Technologies (AAT) performance includes fine-tuning. Assessment rigor: 1 Origin: SCF Created AAT-24.3_A03 documentation covering the extent to which human domain knowledge is employed to improve Artificial Intelligence (AI) and Autonomous Technologies (AAT) performance includes retrieval-augmented generation. Assessment rigor: 1 Origin: SCF Created AAT-24.3_A04 documentation covering the extent to which human domain knowledge is employed to improve Artificial Intelligence (AI) and Autonomous Technologies (AAT) performance includes content moderation. Assessment rigor: 1 Origin: SCF Created AAT-24.3_A05 documentation covering the extent to which human domain knowledge is employed to improve Artificial Intelligence (AI) and Autonomous Technologies (AAT) performance includes business rules. Assessment rigor: 1 Origin: SCF Created
AAT-25 AI & Autonomous Technologies Implementation Tasks Definition – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-25_A01 Artificial Intelligence (AI) and Autonomous Technologies (AAT)-related stakeholders define the tasks that AAT will support (e.g., classifiers, generative models, recommenders). Assessment rigor: 1 Origin: SCF Created
AAT-26 Real World Testing of AI & Autonomous Technologies – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-26_A01 consent is obtained from the subjects of testing Artificial Intelligence (AI) and Autonomous Technologies (AAT) prior to their participation in such testing. Assessment rigor: 1 Origin: SCF Created AAT-26_A02 consent is obtained from the subjects of testing Artificial Intelligence (AI) and Autonomous Technologies (AAT) after they have been provided with clear and concise information regarding the testing. Assessment rigor: 1 Origin: SCF Created
AAT-27 AI & Autonomous Technologies Testing Techniques – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-27_A01 fact-checking techniques are developed to verify the accuracy and veracity of information generated by Artificial Intelligence (AI) and Autonomous Technologies (AAT). Assessment rigor: 1 Origin: SCF Created AAT-27_A02 fact-checking techniques are implemented to verify the accuracy and veracity of information generated by Artificial Intelligence (AI) and Autonomous Technologies (AAT). Assessment rigor: 1 Origin: SCF Created
AAT-27.1 Generative Artificial Intelligence (GAI) Identification – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-27.1_A01 testing techniques are developed to identify Generative Artificial Intelligence (GAI) produced content (e.g., synthetic media). Assessment rigor: 1 Origin: SCF Created AAT-27.1_A02 testing techniques are implemented to identify Generative Artificial Intelligence (GAI) produced content (e.g., synthetic media). Assessment rigor: 1 Origin: SCF Created
AAT-27.2 AI & Autonomous Technologies Capabilities Testing – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-27.2_A01 techniques to delineate human proficiency tests from tests of Artificial Intelligence (AI) and Autonomous Technologies (AAT) capabilities are developed. Assessment rigor: 1 Origin: SCF Created AAT-27.2_A02 techniques to delineate human proficiency tests from tests of Artificial Intelligence (AI) and Autonomous Technologies (AAT) capabilities are implemented. Assessment rigor: 1 Origin: SCF Created
AAT-27.3 Real-World Testing – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-27.3_A01 relevant end-users, practitioners and operators are included in Artificial Intelligence (AI) and Autonomous Technologies (AAT) prototyping and testing activities that cover applicable use case scenarios. Assessment rigor: 1 Origin: SCF Created AAT-27.3_A02 relevant end-users, practitioners and operators are included in Artificial Intelligence (AI) and Autonomous Technologies (AAT) prototyping and testing activities that cover crisis situations. Assessment rigor: 1 Origin: SCF Created AAT-27.3_A03 relevant end-users, practitioners and operators are included in Artificial Intelligence (AI) and Autonomous Technologies (AAT) prototyping and testing activities that cover ethically sensitive contexts. Assessment rigor: 1 Origin: SCF Created
AAT-27.4 Documenting Testing Guidance – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-27.4_A01 instructions for data annotators are documented. Assessment rigor: 1 Origin: SCF Created AAT-27.4_A02 instructions for Artificial Intelligence (AI) and Autonomous Technologies (AAT) red-teamers are documented. Assessment rigor: 1 Origin: SCF Created
AAT-28 Artificial Intelligence Test, Evaluation, Validation & Verification (AI TEVV) – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-28_A01 the organization's Artificial Intelligence Test, Evaluation, Validation & Verification (AI TEVV) capability is organization-wide. Assessment rigor: 1 Origin: 53A_R5_CA-01_ODP[03] AAT-28_A02 a process is implemented to ensure that organizational plans for conducting cybersecurity / data privacy testing, training and monitoring activities associated with organizational systems are developed. Assessment rigor: 1 Origin: 53A_R5_PM-14a.01[01] 53A_R5_PM-14a.01[03] AAT-28_A03 a process is implemented to ensure that organizational plans for conducting cybersecurity / data privacy testing, training and monitoring activities associated with organizational systems are maintained. Assessment rigor: 1 Origin: 53A_R5_PM-14a.01[02] 53A_R5_PM-14a.01[04] AAT-28_A04 a process is implemented to ensure that organizational plans for conducting cybersecurity / data privacy testing, training and monitoring activities associated with organizational systems continue to be executed. Assessment rigor: 1 Origin: 53A_R5_PM-14a.02[01] 53A_R5_PM-14a.02[02] AAT-28_A05 the authorization processes are integrated into an organization-wide risk management program. Assessment rigor: 1 Origin: 53A_R5_PM-10c.
AAT-28.1 AI TEVV Trustworthiness Assessment – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-28.1_A01 the organization's Artificial Intelligence Test, Evaluation, Validation & Verification (AI TEVV) capability evaluates Artificial Intelligence (AI) and Autonomous Technologies (AAT) for trustworthy characteristics. Assessment rigor: 1 Origin: SCF Created
AAT-28.2 AI TEVV Tools – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-28.2_A01 the organization's Artificial Intelligence Test, Evaluation, Validation & Verification (AI TEVV) capability documents test sets used during AI TEVV. Assessment rigor: 1 Origin: SCF Created AAT-28.2_A02 the organization's Artificial Intelligence Test, Evaluation, Validation & Verification (AI TEVV) capability documents metrics used during AI TEVV. Assessment rigor: 1 Origin: SCF Created AAT-28.2_A03 the organization's Artificial Intelligence Test, Evaluation, Validation & Verification (AI TEVV) capability documents details about the tools used during AI TEVV. Assessment rigor: 1 Origin: SCF Created
AAT-28.3 AI TEVV Trustworthiness Demonstration – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-28.3_A01 the organization's Artificial Intelligence Test, Evaluation, Validation & Verification (AI TEVV) capability demonstrates that the Artificial Intelligence (AI) and Autonomous Technologies (AAT) to be deployed are valid. Assessment rigor: 1 Origin: SCF Created
AAT-28.4 AI TEVV Safety Demonstration – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-28.4_A01 the organization's Artificial Intelligence Test, Evaluation, Validation & Verification (AI TEVV) capability demonstrates the Artificial Intelligence (AI) and Autonomous Technologies (AAT) to be deployed are safe. Assessment rigor: 1 Origin: SCF Created AAT-28.4_A02 the organization's Artificial Intelligence Test, Evaluation, Validation & Verification (AI TEVV) capability demonstrates residual negative risk from Artificial Intelligence (AI) and Autonomous Technologies (AAT) does not exceed the organization's risk tolerance. Assessment rigor: 1 Origin: SCF Created AAT-28.4_A03 the organization's Artificial Intelligence Test, Evaluation, Validation & Verification (AI TEVV) capability demonstrates Artificial Intelligence (AI) and Autonomous Technologies (AAT) can fail safely, particularly if made to operate beyond its knowledge limits. Assessment rigor: 1 Origin: SCF Created
AAT-28.5 AI TEVV Security & Resiliency Assessment – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-28.5_A01 the organization's Artificial Intelligence Test, Evaluation, Validation & Verification (AI TEVV) capability evaluates the security of the Artificial Intelligence (AI) and Autonomous Technologies (AAT) to be deployed. Assessment rigor: 1 Origin: SCF Created AAT-28.5_A02 the organization's Artificial Intelligence Test, Evaluation, Validation & Verification (AI TEVV) capability evaluates the resilience of the Artificial Intelligence (AI) and Autonomous Technologies (AAT) to be deployed. Assessment rigor: 1 Origin: SCF Created
AAT-28.6 AI TEVV Transparency & Accountability Assessment – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-28.6_A01 examination of transparency and accountability risks for the Artificial Intelligence (AI) and Autonomous Technologies (AAT) to be deployed is integrated into the organization-wide risk management program. Assessment rigor: 1 Origin: SCF Created AAT-28.6_A02 the organization's Artificial Intelligence Test, Evaluation, Validation & Verification (AI TEVV) capability examines risks associated with transparency and accountability of Artificial Intelligence (AI) and Autonomous Technologies (AAT) to be deployed. Assessment rigor: 1 Origin: SCF Created
AAT-28.7 AI TEVV Privacy Assessment – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-28.7_A01 the organization's Artificial Intelligence Test, Evaluation, Validation & Verification (AI TEVV) capability includes a Data Protection Impact Assessment (DPIA) that identifies and remediates data privacy risks to Personal Data (PD) posed by the Artificial Intelligence (AI) and Autonomous Technologies (AAT) to be deployed. Assessment rigor: 1 Origin: SCF Created
AAT-28.8 AI TEVV Fairness & Bias Assessment – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-28.8_A01 the organization's Artificial Intelligence Test, Evaluation, Validation & Verification (AI TEVV) capability includes examining fairness and bias of Artificial Intelligence (AI) and Autonomous Technologies (AAT) to be deployed. Assessment rigor: 1 Origin: SCF Created
AAT-28.9 AI & Autonomous Technologies Model Validation – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-28.9_A01 the organization's Artificial Intelligence Test, Evaluation, Validation & Verification (AI TEVV) capability includes validating the engineering model used in the design of the Artificial Intelligence (AI) and Autonomous Technologies (AAT) to be deployed. Assessment rigor: 1 Origin: SCF Created
AAT-28.10 AI TEVV Comparable Deployment Settings – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-28.10_A01 the assurance criteria demonstrated by Artificial Intelligence (AI) and Autonomous Technologies (AAT) for conditions prior to deployment are documented. Assessment rigor: 1 Origin: SCF Created AAT-28.10_A02 Artificial Intelligence Test, Evaluation, Validation & Verification (AI TEVV) activities evaluate Artificial Intelligence (AI) and Autonomous Technologies (AAT)-related performance against the assurance criteria demonstrated for conditions prior to deployment. Assessment rigor: 2 Origin: SCF Created
AAT-28.11 AI TEVV Empirically Validated Methods – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-28.11_A01 an empirically validated method to evaluate claims of Artificial Intelligence (AI) and Autonomous Technologies (AAT) model capabilities is defined. Assessment rigor: 1 Origin: SCF Created AAT-28.11_A02 the organization evaluates claims of Artificial Intelligence (AI) and Autonomous Technologies (AAT) model capabilities using an organization-defined empirically validated method. Assessment rigor: 1 Origin: SCF Created
AAT-28.12 AI TEVV Benchmarking Content Provenance – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-28.12_A01 a method to benchmark the verifiable lineage and origin of content used by Artificial Intelligence (AI) and Autonomous Technologies (AAT) according to industry-recognized standards is defined. Defined parameters: at a minimum, a recognized content provenance specification, for example the Coalition for Content Provenance and Authenticity (C2PA) content credentials specification Assessment rigor: 1 Origin: SCF Created AAT-28.12_A02 the organization benchmarks the verifiable lineage and origin of content used by Artificial Intelligence (AI) and Autonomous Technologies (AAT). Assessment rigor: 1 Origin: SCF Created
AAT-28.13 AI TEVV Model Collapse Mitigations – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-28.13_A01 the organization mitigates concerns of model collapse by assessing the proportion of synthetic to non-synthetic training data. Assessment rigor: 1 Origin: SCF Created AAT-28.13_A02 the organization mitigates concerns of model collapse by verifying training data is not homogenous beyond organization-defined thresholds and is not produced by Artificial Intelligence (AI) and Autonomous Technologies (AAT). Assessment rigor: 1 Origin: SCF Created
AAT-28.14 AI TEVV Third-Party Risk Management – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-28.14_A01 third-party Artificial Intelligence (AI) and Autonomous Technologies (AAT)-related components are assessed and approved. Assessment rigor: 1 Origin: SCF Created AAT-28.14_A02 third-party Artificial Intelligence (AI) and Autonomous Technologies (AAT)-related Application Programming Interfaces (APIs) are assessed and approved. Assessment rigor: 1 Origin: SCF Created AAT-28.14_A03 third-party Artificial Intelligence (AI) and Autonomous Technologies (AAT)-related services used by AI agents for security, privacy and compliance are assessed and approved. Assessment rigor: 1 Origin: SCF Created
AAT-29 AI TEVV Results Evaluation – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-29_A01 the organization's Artificial Intelligence Test, Evaluation, Validation & Verification (AI TEVV) capability includes a determination on the viability of the proposed Artificial Intelligence (AI) and Autonomous Technologies (AAT). Assessment rigor: 1 Origin: SCF Created
AAT-29.1 AI TEVV Effectiveness – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-29.1_A01 After Action Reviews (AARs), or similar lessons learned exercises, are conducted after each Artificial Intelligence Test, Evaluation, Validation & Verification (AI TEVV) cycle to evaluate the effectiveness of the AI TEVV processes. Assessment rigor: 1 Origin: SCF Created
AAT-30 AI TEVV Reporting – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-30_A01 results from Artificial Intelligence Test, Evaluation, Validation & Verification (AI TEVV) are documented. Assessment rigor: 1 Origin: SCF Created AAT-30_A02 the status and results of Artificial Intelligence Test, Evaluation, Validation & Verification (AI TEVV) are reported to relevant stakeholders, including governing bodies, per an organization-defined frequency. Defined parameters: at least annually Assessment rigor: 1 Origin: SCF Created
AAT-30.1 AI & Autonomous Technologies Residual Risks – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-30.1_A01 residual risks (defined as the sum of all unmitigated risks) to both downstream acquirers and end users of Artificial Intelligence (AI) and Autonomous Technologies (AAT) are identified. Assessment rigor: 1 Origin: SCF Created AAT-30.1_A02 residual risks (defined as the sum of all unmitigated risks) to both downstream acquirers and end users of Artificial Intelligence (AI) and Autonomous Technologies (AAT) are documented in a Plan of Action & Milestones (POA&M), or similar risk register. Assessment rigor: 1 Origin: SCF Created
AAT-30.2 AI & Autonomous Technologies Viability Decisions – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-30.2_A01 an executive steering committee, or advisory board, defines criteria as to whether Artificial Intelligence (AI) and Autonomous Technologies (AAT) achieved intended purposes and stated objectives. Assessment rigor: 1 Origin: SCF Created AAT-30.2_A02 measures exist for the executive steering committee, or advisory board, to determine whether Artificial Intelligence (AI) and Autonomous Technologies (AAT) development or deployment should proceed. Assessment rigor: 1 Origin: SCF Created
AAT-31 AI TEVV Post-Deployment Monitoring – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-31_A01 the organization's Artificial Intelligence Test, Evaluation, Validation & Verification (AI TEVV) capability includes proactive and continuous monitoring of deployed Artificial Intelligence (AI) and Autonomous Technologies (AAT). Assessment rigor: 1 Origin: SCF Created
AAT-32 Updating AI & Autonomous Technologies – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-32_A01 continual improvements for deployed Artificial Intelligence (AI) and Autonomous Technologies (AAT) are identified. Assessment rigor: 1 Origin: SCF Created AAT-32_A02 identified continual improvements for deployed Artificial Intelligence (AI) and Autonomous Technologies (AAT) are implemented. Assessment rigor: 1 Origin: SCF Created
AAT-33 Robust Stakeholder Engagement for AI & Autonomous Technologies – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-33_A01 roles and responsibilities exist to compel data and/or process owners to conduct ongoing engagement with relevant Artificial Intelligence (AI) and Autonomous Technologies (AAT) stakeholders to encourage feedback about positive, negative and unanticipated impacts. Defined parameters: at least annually Assessment rigor: 1 Origin: SCF Created AAT-33_A02 Individual Contributor (IC) performance reviews cover how data and/or process owners conducted engagement with relevant Artificial Intelligence (AI) and Autonomous Technologies (AAT) stakeholders to encourage feedback about positive, negative and unanticipated impacts. Assessment rigor: 1 Origin: SCF Created
AAT-33.1 AI & Autonomous Technologies Stakeholder Feedback Integration – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-33.1_A01 roles and responsibilities exist to compel data and/or process owners to collect, consider, prioritize and integrate risk-related feedback, per an organization-defined frequency, from those external to the team that developed or deployed Artificial Intelligence (AI) and Autonomous Technologies (AAT). Defined parameters: at least annually Assessment rigor: 1 Origin: SCF Created AAT-33.1_A02 Individual Contributor (IC) performance reviews cover how data and/or process owners collected, considered, prioritized and integrated risk-related feedback on Artificial Intelligence (AI) and Autonomous Technologies (AAT) per an organization-defined frequency. Defined parameters: at least annually Assessment rigor: 1 Origin: SCF Created
AAT-33.2 AI & Autonomous Technologies Ongoing Assessments – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-33.2_A01 independent assessors and/or internal stakeholders, who did not serve as front-line developers, are utilized for assessments and updates of deployed Artificial Intelligence (AI) and Autonomous Technologies (AAT) per an organization-defined frequency. Defined parameters: at least annually Assessment rigor: 1 Origin: SCF Created
AAT-33.3 AI & Autonomous Technologies End User Feedback – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-33.3_A01 the organization collects feedback from end users and impacted communities for use in Artificial Intelligence (AI) and Autonomous Technologies (AAT)-related system evaluation metrics. Assessment rigor: 1 Origin: SCF Created AAT-33.3_A02 feedback from end users and impacted communities is integrated into Artificial Intelligence (AI) and Autonomous Technologies (AAT)-related system evaluation metrics. Assessment rigor: 1 Origin: SCF Created
AAT-33.4 AI & Autonomous Technologies Incident & Error Reporting – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-33.4_A01 pertinent information from Artificial Intelligence (AI) and Autonomous Technologies (AAT)-related incidents and/or errors is communicated to relevant stakeholders, including affected communities. Defined parameters: within the period required by the applicable statutory, regulatory or contractual notification obligation, and no later than the shortest applicable deadline Assessment rigor: 1 Origin: SCF Created
AAT-34 AI & Autonomous Technologies Stakeholder Diversity – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-34_A01 Artificial Intelligence (AI) and Autonomous Technologies (AAT) stakeholder competencies, skills and capacities incorporate demographic diversity. Assessment rigor: 1 Origin: SCF Created AAT-34_A02 Artificial Intelligence (AI) and Autonomous Technologies (AAT) stakeholder competencies, skills and capacities incorporate broad domain expertise. Assessment rigor: 1 Origin: SCF Created AAT-34_A03 Artificial Intelligence (AI) and Autonomous Technologies (AAT) stakeholder competencies, skills and capacities incorporate broad user experience expertise. Assessment rigor: 1 Origin: SCF Created
AAT-34.1 AI & Autonomous Technologies Stakeholder Competencies – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-34.1_A01 roles and responsibilities exist to compel data and/or process owners to meet documented Artificial Intelligence (AI) and Autonomous Technologies (AAT) operator and practitioner proficiency requirements. Assessment rigor: 1 Origin: SCF Created AAT-34.1_A02 the organization assesses Artificial Intelligence (AI) and Autonomous Technologies (AAT)-related operator and practitioner proficiency requirements per an organization-defined frequency. Defined parameters: at least annually Assessment rigor: 1 Origin: SCF Created AAT-34.1_A03 roles and responsibilities are updated as Artificial Intelligence (AI) and Autonomous Technologies (AAT)-related operator and practitioner proficiency requirements evolve. Assessment rigor: 1 Origin: SCF Created
AAT-35 AI & Autonomous Technologies Deployment – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-35_A01 the deployment of Artificial Intelligence (AI) and Autonomous Technologies (AAT) includes documented technical and organizational measures so that AAT are used in accordance with the AAT developer-provided instructions. Assessment rigor: 1 Origin: SCF Created
AAT-35.1 AI & Autonomous Technologies Human Oversight – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-35.1_A01 human oversight of Artificial Intelligence (AI) and Autonomous Technologies (AAT) is assigned to one or more individuals to prevent or minimize AAT-related risks. Assessment rigor: 1 Origin: SCF Created AAT-35.1_A02 human oversight of Artificial Intelligence (AI) and Autonomous Technologies (AAT) focuses on preventing, or minimizing, risks associated with an individual's health. Assessment rigor: 1 Origin: SCF Created AAT-35.1_A03 human oversight of Artificial Intelligence (AI) and Autonomous Technologies (AAT) focuses on preventing, or minimizing, risks associated with an individual's safety. Assessment rigor: 1 Origin: SCF Created AAT-35.1_A04 human oversight of Artificial Intelligence (AI) and Autonomous Technologies (AAT) focuses on preventing, or minimizing, risks associated with an individual's fundamental rights. Assessment rigor: 1 Origin: SCF Created
AAT-35.2 AI & Autonomous Technologies Oversight Measures – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-35.2_A01 oversight measures for Artificial Intelligence (AI) and Autonomous Technologies (AAT) are commensurate with the AAT's assessed risk(s). Assessment rigor: 1 Origin: SCF Created AAT-35.2_A02 oversight measures for Artificial Intelligence (AI) and Autonomous Technologies (AAT) are commensurate with the AAT's level of autonomy. Assessment rigor: 1 Origin: SCF Created AAT-35.2_A03 oversight measures for Artificial Intelligence (AI) and Autonomous Technologies (AAT) are commensurate with the AAT's context of use. Assessment rigor: 1 Origin: SCF Created
AAT-35.3 AI & Autonomous Technologies Separate Verification – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-35.3_A01 no action or decision is taken by the deployer of Artificial Intelligence (AI) and Autonomous Technologies (AAT) solely on the basis of AAT-generated evidence, unless that evidence has been separately verified and confirmed by at least two (2) individuals with the necessary competence, training and authority. Assessment rigor: 1 Origin: SCF Created
AAT-35.4 AI & Autonomous Technologies Oversight Functions Competency – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-35.4_A01 human oversight of Artificial Intelligence (AI) and Autonomous Technologies (AAT) is assigned to individuals who have the necessary competence. Assessment rigor: 1 Origin: SCF Created AAT-35.4_A02 human oversight of Artificial Intelligence (AI) and Autonomous Technologies (AAT) is assigned to individuals who have the necessary training. Assessment rigor: 1 Origin: SCF Created AAT-35.4_A03 human oversight of Artificial Intelligence (AI) and Autonomous Technologies (AAT) is assigned to individuals who have the necessary authority. Assessment rigor: 1 Origin: SCF Created AAT-35.4_A04 human oversight of Artificial Intelligence (AI) and Autonomous Technologies (AAT) is assigned to individuals who have the necessary resources. Assessment rigor: 1 Origin: SCF Created
AAT-35.5 AI & Autonomous Technologies Data Relevance – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-35.5_A01 input to Artificial Intelligence (AI) and Autonomous Technologies (AAT) is limited to data that is relevant to the intended purpose of the AAT. Assessment rigor: 1 Origin: SCF Created
AAT-35.6 AI & Autonomous Technologies Irregularity Reporting – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-35.6_A01 serious incidents and/or irregularities associated with the deployment of Artificial Intelligence (AI) and Autonomous Technologies (AAT) are reported to the AAT provider within an organization-defined period. Defined parameters: no more than 72 hours after the serious incident or irregularity is identified Assessment rigor: 1 Origin: SCF Created AAT-35.6_A02 serious incidents and/or irregularities associated with the deployment of Artificial Intelligence (AI) and Autonomous Technologies (AAT) are reported to the AAT importer or distributor within an organization-defined period, where the AAT was obtained through an importer or distributor. Defined parameters: no more than 72 hours after the serious incident or irregularity is identified Assessment rigor: 1 Origin: SCF Created AAT-35.6_A03 serious incidents and/or irregularities associated with the deployment of Artificial Intelligence (AI) and Autonomous Technologies (AAT) are reported to local law enforcement authorities and/or governmental agencies within the period required by applicable statutory or regulatory requirements. Defined parameters: no later than the shortest applicable statutory or regulatory reporting deadline Assessment rigor: 1 Origin: SCF Created
AAT-35.7 AI & Autonomous Technologies Use Notification To Employees – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-35.7_A01 methods to identify the employees, including workers' representatives, who are to be informed of Artificial Intelligence (AI) and Autonomous Technologies (AAT) deployments are defined. Assessment rigor: 1 Origin: SCF Created AAT-35.7_A02 the employees, including workers' representatives, who are to be informed of Artificial Intelligence (AI) and Autonomous Technologies (AAT) deployments are identified. Assessment rigor: 1 Origin: SCF Created AAT-35.7_A03 employees, including workers' representatives, are informed about Artificial Intelligence (AI) and Autonomous Technologies (AAT) deployments prior to the use of the AAT in a production environment. Defined parameters: no later than the notice period required by applicable labor law or collective agreement Assessment rigor: 1 Origin: SCF Created
AAT-35.8 AI & Autonomous Technologies Use Notification To Users – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-35.8_A01 when Artificial Intelligence (AI) and Autonomous Technologies (AAT) are used to make decisions, or assist in making decisions, affected people are notified in a clear manner that they are utilizing an AAT solution. Assessment rigor: 1 Origin: SCF Created AAT-35.8_A02 when AAT are used to make decisions, or assist in making decisions, affected people are notified in a clear manner that they are expected to validate the output for relevance and accuracy. Assessment rigor: 1 Origin: SCF Created
AAT-36 AI & Autonomous Technologies Production Monitoring – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-36_A01 responsible party(ies) monitor the functionality and behavior of deployed Artificial Intelligence (AI) and Autonomous Technologies (AAT) for anomalous performance or outcomes inconsistent with intended use. Assessment rigor: 1 Origin: SCF Created
AAT-36.1 AI & Autonomous Technologies Measurement Approaches – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-36.1_A01 a risk catalog of Artificial Intelligence (AI) and Autonomous Technologies (AAT)-specific risks is documented. Assessment rigor: 1 Origin: SCF Created AAT-36.1_A02 Artificial Intelligence (AI) and Autonomous Technologies (AAT)-related risks are identified through consultation with domain experts and other end users. Assessment rigor: 1 Origin: SCF Created
AAT-36.2 Measuring AI & Autonomous Technologies Effectiveness – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-36.2_A01 the effectiveness of existing Artificial Intelligence (AI) and Autonomous Technologies (AAT)-related security, compliance and resilience controls is assessed per an organization-defined frequency, including reports of errors and potential impacts on affected communities. Defined parameters: at least annually Assessment rigor: 1 Origin: SCF Created AAT-36.2_A02 the frequency at which to assess the effectiveness of Artificial Intelligence (AI) and Autonomous Technologies (AAT)-related security, compliance and resilience controls is defined. Defined parameters: at least annually Assessment rigor: 1 Origin: SCF Created
AAT-36.3 Unmeasurable AI & Autonomous Technologies Risks – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-36.3_A01 responsible party(ies) that monitor the functionality and behavior of deployed Artificial Intelligence (AI) and Autonomous Technologies (AAT) are trained on identifying unmeasurable risks or trustworthiness characteristics. Defined parameters: at least annually Assessment rigor: 1 Origin: SCF Created AAT-36.3_A02 unmeasurable risks or trustworthiness characteristics related to Artificial Intelligence (AI) and Autonomous Technologies (AAT) are reported in accordance with the organization's Incident Response Plan (IRP). Assessment rigor: 1 Origin: SCF Created AAT-36.3_A03 unmeasurable risks or trustworthiness characteristics related to Artificial Intelligence (AI) and Autonomous Technologies (AAT) are identified. Assessment rigor: 1 Origin: SCF Created AAT-36.3_A04 unmeasurable risks or trustworthiness characteristics related to Artificial Intelligence (AI) and Autonomous Technologies (AAT) are documented in a risk register, Plan of Action & Milestones (POA&M) or similar record. Assessment rigor: 1 Origin: SCF Created
AAT-36.4 Efficacy of AI & Autonomous Technologies Measurement – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-36.4_A01 responsible party(ies) gather feedback about efficacy of Artificial Intelligence (AI) and Autonomous Technologies (AAT)-related measurements. Assessment rigor: 1 Origin: SCF Created AAT-36.4_A02 an executive steering committee, or advisory board, assesses the efficacy of Artificial Intelligence (AI) and Autonomous Technologies (AAT)-related measurements. Defined parameters: at least annually Assessment rigor: 1 Origin: SCF Created
AAT-36.5 AI & Autonomous Technologies Domain Expert Reviews – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-36.5_A01 input from domain experts and relevant stakeholders is utilized to validate whether the Artificial Intelligence (AI) and Autonomous Technologies (AAT) perform consistently, as intended. Defined parameters: at least annually Assessment rigor: 1 Origin: SCF Created
AAT-36.6 AI & Autonomous Technologies Performance Changes – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-36.6_A01 an executive steering committee, or advisory board, evaluates performance improvements or declines with domain experts and relevant stakeholders to define context-relevant risks and trustworthiness issues. Defined parameters: at least annually Assessment rigor: 1 Origin: SCF Created
AAT-36.7 Pre-Trained AI & Autonomous Technologies Models – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-36.7_A01 the information source(s) and quality of pre-trained models used in Artificial Intelligence (AI) and Autonomous Technologies (AAT) training, maintenance and improvement-related activities are validated. Assessment rigor: 1 Origin: SCF Created
AAT-36.8 AI & Autonomous Technologies Event Logging – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-36.8_A01 Artificial Intelligence (AI) and Autonomous Technologies (AAT) system event logging capabilities are configured to provide start date, start time, end date and end time for each use. Assessment rigor: 1 Origin: SCF Created AAT-36.8_A02 Artificial Intelligence (AI) and Autonomous Technologies (AAT) system event logging capabilities are configured to provide database(s) against which input data has been checked by the system. Assessment rigor: 1 Origin: SCF Created AAT-36.8_A03 Artificial Intelligence (AI) and Autonomous Technologies (AAT) system event logging capabilities are configured to provide input data for which the search has led to a match. Assessment rigor: 1 Origin: SCF Created AAT-36.8_A04 Artificial Intelligence (AI) and Autonomous Technologies (AAT) system event logging capabilities are configured to provide identification of individual(s) involved in the verification of the results. Assessment rigor: 1 Origin: SCF Created
AAT-36.9 Serious Incident Reporting For AI & Autonomous Technologies – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-36.9_A01 criteria to define a "serious incident" involving operational Artificial Intelligence (AI) and Autonomous Technologies (AAT) are defined. Assessment rigor: 1 Origin: SCF Created AAT-36.9_A02 the organization reports any serious incident involving operational Artificial Intelligence (AI) and Autonomous Technologies (AAT) to relevant authorities as to when and where the serious incident occurred, in accordance with mandated reporting timelines. Defined parameters: the reporting timeline required by the applicable statutory, regulatory or contractual obligation, and no longer than the shortest applicable deadline Assessment rigor: 1 Origin: SCF Created
AAT-36.10 Serious Incident Root Cause Analysis (RCA) For AI & Autonomous Technologies – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-36.10_A01 the investigation of a serious incident involving operational Artificial Intelligence (AI) and Autonomous Technologies (AAT) documents a Root Cause Analysis (RCA). Assessment rigor: 1 Origin: SCF Created AAT-36.10_A02 the investigation of a serious incident involving operational Artificial Intelligence (AI) and Autonomous Technologies (AAT) documents a risk assessment of the incident. Assessment rigor: 1 Origin: SCF Created AAT-36.10_A03 the investigation of a serious incident involving operational Artificial Intelligence (AI) and Autonomous Technologies (AAT) documents a description of corrective actions taken, including measures implemented to prevent a recurrence of the incident. Assessment rigor: 1 Origin: SCF Created
AAT-36.11 Anomaly Detection & Human Oversight – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-36.11_A01 a real-time review capability enables personnel to analyze anomalous Artificial Intelligence (AI) and Autonomous Technologies (AAT) behavior. Assessment rigor: 1 Origin: SCF Created AAT-36.11_A02 escalation paths enable human intervention to address AAT anomalies. Assessment rigor: 1 Origin: SCF Created
AAT-36.12 Human-in-the-Loop & Escalation – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-36.12_A01 human review is performed for high-risk or ambiguous Artificial Intelligence (AI) and Autonomous Technologies (AAT) actions. Assessment rigor: 1 Origin: SCF Created AAT-36.12_A02 clear escalation paths for approval exist for instances involving high-risk or ambiguous AAT actions. Assessment rigor: 1 Origin: SCF Created
AAT-36.13 Emergent Behavior & Collusion Protections – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-36.13_A01 the organization has the ability to detect emergent or collusive behaviors among multiple Artificial Intelligence (AI) and Autonomous Technologies (AAT). Assessment rigor: 1 Origin: SCF Created AAT-36.13_A02 the organization has the ability to contain emergent or collusive behaviors among multiple AAT through automated or human-triggered means. Assessment rigor: 1 Origin: SCF Created AAT-36.13_A03 formal investigation determines the root cause of agentic cascades or collusion. Assessment rigor: 1 Origin: SCF Created
AAT-36.14 Multi-Agent Trust & Communication Validation – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-36.14_A01 AI agent to AI agent communications are validated to detect poisoning or consensus manipulation. Assessment rigor: 1 Origin: SCF Created AAT-36.14_A02 AI agent to AI agent communications are validated to identify rogue or compromised AI agents in distributed or multi-agent environments. Assessment rigor: 1 Origin: SCF Created
AAT-37 AI & Autonomous Technologies System Value Chain – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-37_A01 the sequence of events involved in creating and deploying Artificial Intelligence (AI) and Autonomous Technologies (AAT) is documented. Assessment rigor: 1 Origin: SCF Created AAT-37_A02 the relevant stakeholders involved in creating and deploying Artificial Intelligence (AI) and Autonomous Technologies (AAT) are documented. Assessment rigor: 1 Origin: SCF Created
AAT-37.1 AI & Autonomous Technologies System Value Chain Fallbacks – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-37.1_A01 over-reliance on third-party data with Artificial Intelligence (AI) and Autonomous Technologies (AAT) is identified. Assessment rigor: 1 Origin: SCF Created AAT-37.1_A02 fallback methods are identified to address the inability to access third-party data on which Artificial Intelligence (AI) and Autonomous Technologies (AAT) depend. Assessment rigor: 1 Origin: SCF Created
AAT-38 AI Model Resilience – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-38_A01 AI models are designed with resilience capabilities that address threats identified through the organization's risk assessment process. Assessment rigor: 1 Origin: SCF Created
AAT-38.1 AI Model Pollution – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-38.1_A01 technical controls prevent "model pollution" due to accidental and/or malicious inputs by an AI agent that can negatively alter the AI model. Assessment rigor: 1 Origin: SCF Created
AAT-38.2 Cascading Hallucination Defense – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-38.2_A01 a capability exists to detect false data (e.g., hallucinations) within the AI model or between AI agents. Assessment rigor: 1 Origin: SCF Created AAT-38.2_A02 a capability exists to prevent the propagation of false data (e.g., hallucinations) within the AI model or between AI agents. Assessment rigor: 1 Origin: SCF Created
AAT-38.3 Resource Exhaustion & Denial of Service (DoS) Resilience – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-38.3_A01 resource overload and Denial of Service (DoS) conditions are monitored. Defined parameters: continuously Assessment rigor: 1 Origin: SCF Created AAT-38.3_A02 resource overload and Denial of Service (DoS) conditions are prevented through the enforcement of quotas. Assessment rigor: 1 Origin: SCF Created AAT-38.3_A03 resource overload and Denial of Service (DoS) conditions are prevented through workload controls. Assessment rigor: 1 Origin: SCF Created AAT-38.3_A04 resource overload and Denial of Service (DoS) conditions are prevented through auto-suspension of runaway AI agent processes. Assessment rigor: 1 Origin: SCF Created
AAT-39 AI Agent Governance – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-39_A01 AI agents are designed to securely operate under human oversight. Assessment rigor: 1 Origin: SCF Created AAT-39_A02 AI agents are developed to securely operate under human oversight. Assessment rigor: 1 Origin: SCF Created AAT-39_A03 AI agents are deployed to securely operate under human oversight. Assessment rigor: 1 Origin: SCF Created
AAT-39.1 Infrastructure Hardening & Isolation – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-39.1_A01 infrastructure resources used by AI agents are protected through resource allocation. Assessment rigor: 1 Origin: SCF Created AAT-39.1_A02 infrastructure resources used by AI agents are protected through privilege management. Assessment rigor: 1 Origin: SCF Created AAT-39.1_A03 infrastructure resources used by AI agents are protected through network segmentation. Assessment rigor: 1 Origin: SCF Created AAT-39.1_A04 infrastructure resources used by AI agents are protected through workload isolation. Assessment rigor: 1 Origin: SCF Created
AAT-39.2 AI Agent Limitations – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-39.2_A01 limitations are implemented for AI agents according to least privileges, where the AI agent operates with the minimal permissions necessary to perform designated tasks. Assessment rigor: 1 Origin: SCF Created AAT-39.2_A02 limitations are implemented for AI agents according to least functionality, where the AI agent is restricted to communicate with the minimal Technology Assets, Applications and/or Services (TAAS) and networks necessary to perform designated tasks. Assessment rigor: 1 Origin: SCF Created
AAT-39.3 Tool & Application Programming Interface (API) Invocation Controls – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-39.3_A01 all tool and Application Programming Interface (API) invocations by AI agents are subject to schema validation. Assessment rigor: 1 Origin: SCF Created AAT-39.3_A02 all tool and API invocations by AI agents are subject to rate limiting. Assessment rigor: 1 Origin: SCF Created AAT-39.3_A03 all tool and API invocations by AI agents are subject to access controls. Assessment rigor: 1 Origin: SCF Created AAT-39.3_A04 all tool and API invocations by AI agents are subject to output validation. Assessment rigor: 1 Origin: SCF Created
AAT-39.4 AI Agent Orchestration Protocol Safeguards – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-39.4_A01 AI agent orchestration protocols are configured to prevent unauthorized tool chaining. Assessment rigor: 1 Origin: SCF Created AAT-39.4_A02 AI agent orchestration protocols are configured to prevent context manipulation. Assessment rigor: 1 Origin: SCF Created AAT-39.4_A03 AI agent orchestration protocols are configured to prevent protocol-based escalation. Assessment rigor: 1 Origin: SCF Created
AAT-39.5 AI Agent Data Pipeline & Input Integrity – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-39.5_A01 data inputs and retrieval pipelines for AI agents are validated to establish data provenance. Assessment rigor: 1 Origin: SCF Created AAT-39.5_A02 data inputs and retrieval pipelines for AI agents prevent unauthorized access risks (e.g., injection, manipulation or exfiltration). Assessment rigor: 1 Origin: SCF Created
AAT-39.6 AI Agent Privileged Role & Delegation Boundaries – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-39.6_A01 instances of privilege escalation or unauthorized delegation by AI agents are monitored. Defined parameters: continuously Assessment rigor: 1 Origin: SCF Created AAT-39.6_A02 privilege escalation or unauthorized delegation by AI agents is prevented through dynamic role enforcement. Assessment rigor: 1 Origin: SCF Created AAT-39.6_A03 privilege escalation or unauthorized delegation by AI agents is prevented through establishing cross-agent delegation boundaries and privileged actions. Assessment rigor: 1 Origin: SCF Created
AAT-39.7 AI Agent Data Access Restrictions – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-39.7_A01 AI agent access to sensitive and/or regulated data is restricted so that AI agents cannot ingest, generate or act on unauthorized data without proper permissions. Assessment rigor: 1 Origin: SCF Created
AAT-39.8 AI Agent Data Extraction – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-39.8_A01 AI agents are prevented from extracting sensitive/regulated data from volatile memory. Assessment rigor: 1 Origin: SCF Created
AAT-39.9 AI Agent Identity & Impersonation Defense – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-39.9_A01 user identification and authentication methods are capable of preventing AI agents from spoofing. Assessment rigor: 1 Origin: SCF Created AAT-39.9_A02 user identification and authentication methods are capable of preventing AI agents from mimicry. Assessment rigor: 1 Origin: SCF Created AAT-39.9_A03 user identification and authentication methods are capable of preventing AI agents from impersonation attacks. Assessment rigor: 1 Origin: SCF Created
AAT-39.10 AI Agent Logic Integrity – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-39.10_A01 AI agent logic is protected from being subverted or manipulated. Assessment rigor: 1 Origin: SCF Created
AAT-39.11 Sandboxing AI Agents – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-39.11_A01 a "sandbox" capability restricts AI agents from unrestricted access to local resources (e.g., Data, Assets, Applications & Services (DAAS) on the local network). Assessment rigor: 1 Origin: SCF Created AAT-39.11_A02 a "sandbox" capability restricts AI agents from unrestricted access to remote resources (e.g., Internet-based DAAS). Assessment rigor: 1 Origin: SCF Created
AAT-39.12 AI Agent Prompt Injection Defense – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-39.12_A01 prompt injection / input attacks that seek to manipulate AI agent instructions, bypass controls or result in unauthorized actions can be detected. Assessment rigor: 1 Origin: SCF Created AAT-39.12_A02 means to prevent or mitigate prompt injection / input attacks that seek to manipulate AI agent instructions, bypass controls or result in unauthorized actions are implemented. Assessment rigor: 1 Origin: SCF Created
AAT-39.13 AI Agent Kill Switch / User Control – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-39.13_A01 authorized users or operators have the ability to immediately halt or disable AI agent activity in case of unexpected behavior or harm. Assessment rigor: 1 Origin: SCF Created
AAT-39.14 AI Agent Adversarial & Red Team Testing – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-39.14_A01 adversarial testing that simulates attacks against AI agents to identify and mitigate vulnerabilities is conducted per an organization-defined frequency. Defined parameters: at least annually Assessment rigor: 1 Origin: SCF Created
AAT-39.15 AI Agent Self-Modification Controls – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-39.15_A01 AI agent self-modification is controlled / restricted. Assessment rigor: 1 Origin: SCF Created AAT-39.15_A02 AI agent self-modification actions are logged. Assessment rigor: 1 Origin: SCF Created
AAT-39.16 Purging AI Agent Data – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-39.16_A01 unauthorized purging of persistent memory or long-term data used by AI agents is prevented. Assessment rigor: 1 Origin: SCF Created
AAT-39.17 AI Agent Delegation and Chaining Control – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-39.17_A01 agentic delegation, chaining and/or multi-agent communication are controlled to prevent unauthorized task escalation or emergent risks. Assessment rigor: 1 Origin: SCF Created
AAT-39.18 AI Agent Behavioral Drift Detection – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-39.18_A01 indicators of behavioral drift or deviation from established AI agent baselines are continuously monitored. Assessment rigor: 1 Origin: SCF Created
AAT-39.19 AI Agent Action Authentication & Authorization – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-39.19_A01 all AI agent-initiated actions are mapped to authenticated user or system identities, with enforced authorization checks. Assessment rigor: 1 Origin: SCF Created
AAT-39.20 AI Agent Transparency & Audit – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-39.20_A01 comprehensive audit trails of AI agent actions provide rationales. Assessment rigor: 1 Origin: SCF Created AAT-39.20_A02 comprehensive audit trails of AI agent actions provide user/trigger mappings. Assessment rigor: 1 Origin: SCF Created
AAT-39.21 AI Agent Explainability – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-39.21_A01 human-understandable explanations for significant AI agent actions or decisions are provided to users. Assessment rigor: 1 Origin: SCF Created AAT-39.21_A02 end users are able to contest AI agent-generated outcomes. Assessment rigor: 1 Origin: SCF Created
AAT-39.22 AI Agent Ethics, Fairness & Bias Detection – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-39.22_A01 unfair, unethical or biased AI agent actions are detected. Assessment rigor: 1 Origin: SCF Created
AAT-39.23 AI Agent Output Integrity & Verification – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-39.23_A01 AI agent-generated outputs are validated through content scanning. Assessment rigor: 1 Origin: SCF Created AAT-39.23_A02 AI agent-generated outputs are validated through output vetting that uses human review and approvals for organization-defined categories of output. Defined parameters: at a minimum, output that is externally released or used in decisions affecting individuals Assessment rigor: 1 Origin: SCF Created
AAT-39.24 AI Agent Resource Limiting – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-39.24_A01 automated mechanisms enforce resource limits for Artificial Intelligence (AI) and Autonomous Technologies (AAT). Assessment rigor: 1 Origin: SCF Created AAT-39.24_A02 enforced resource limits address energy consumption. Assessment rigor: 1 Origin: SCF Created AAT-39.24_A03 enforced resource limits address processing capacity. Assessment rigor: 1 Origin: SCF Created AAT-39.24_A04 enforced resource limits address financial consumption (e.g., allocated budget). Assessment rigor: 1 Origin: SCF Created
AAT-40 Agentic Output Traceability & Repudiation – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-40_A01 AI agent actions provide non-repudiation that supports the determination of accountability. Assessment rigor: 1 Origin: SCF Created AAT-40_A02 AI agent actions are able to be forensically examined to determine accountability. Assessment rigor: 1 Origin: SCF Created
AAT-40.1 AI Agent Logging – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-40.1_A01 event logs are generated for Artificial Intelligence (AI) and Autonomous Technologies (AAT) actions. Assessment rigor: 1 Origin: SCF Created
AAT-40.2 AI Agent Session Management – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-40.2_A01 AI agent sessions are controlled by embedding session IDs into the requests to the AI model. Assessment rigor: 1 Origin: SCF Created AAT-40.2_A02 AI agent sessions are controlled by implementing capabilities to correlate sessions. Assessment rigor: 1 Origin: SCF Created AAT-40.2_A03 AI agent sessions are controlled by terminating sessions after a defined time period. Defined parameters: no more than 15 minutes of inactivity Assessment rigor: 1 Origin: SCF Created
AAT-41 Human-in-the-Loop Workload & Manipulation – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-41_A01 risk-based prioritization is implemented to prevent cognitive overload or decision fatigue for humans-in-the-loop (HITL). Assessment rigor: 1 Origin: SCF Created
AAT-42 Robotic Process Automation (RPA) – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-42_A01 Robotic Process Automation (RPA) is implemented to improve efficiency, accuracy and speed in instances of high-volume, repetitive and rules-based business processes. Assessment rigor: 1 Origin: SCF Created
AAT-43 Business Process Task Enumeration – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AAT-43_A01 business process task activities that can be executed both manually and in an automated fashion are identified. Assessment rigor: 1 Origin: SCF Created AAT-43_A02 business process task activities that can be executed both manually and in an automated fashion are enumerated. Assessment rigor: 1 Origin: SCF Created
AST-01 Asset Management Policy – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AST-01_A01 a formal, documented asset management policy is approved by executive management, or a formally delegated authority, and conveys executive management's intent for asset management. Assessment rigor: 1 Origin: SCF Created AST-01_A02 the asset management policy provides organizational direction and states the behaviors expected of personnel and other applicable parties with respect to asset management. Assessment rigor: 1 Origin: SCF Created AST-01_A03 the current version of the asset management policy is communicated to, and accessible by, the personnel and other applicable parties who are expected to comply with it. Assessment rigor: 1 Origin: SCF Created AST-01_A04 the asset management policy is reviewed at least annually. Defined parameters: at least annually Assessment rigor: 1 Origin: SCF Created AST-01_A05 the asset management policy is updated, as necessary, in response to changes in risks, threats, business practices and/or statutory, regulatory and contractual obligations that affect the organization. Assessment rigor: 1 Origin: SCF Created
AST-02 Asset Governance – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AST-02_A01 an authoritative source and repository are established to provide a trusted source and accountability for approved and implemented systems and system components. Assessment rigor: 1 Origin: 172A_3.4.1e[c] 172A_3.4.1e[d] AST-02_A02 the frequency at which to review / update the system and system component inventory is defined. Defined parameters: at least annually Assessment rigor: 1 Origin: 53A_R5_CM-08_ODP[02] AST-02_A03 an inventory of systems and system components that is at the level of granularity deemed necessary for tracking and reporting is developed and documented. Assessment rigor: 1 Origin: 53A_R5_CM-08a.04 AST-02_A04 IT Asset Management (ITAM) operations are conducted according to documented policies, standards, procedures and/or other organizational directives. Assessment rigor: 1 Origin: SCF Created AST-02_A05 the resources (people, processes, technologies, data and/or facilities) identified as necessary for IT Asset Management (ITAM) operations are allocated. Assessment rigor: 1 Origin: SCF Created AST-02_A06 responsibility and authority for the performance of IT Asset Management (ITAM)-related activities are assigned to designated personnel. Assessment rigor: 1 Origin: SCF Created AST-02_A07 personnel performing IT Asset Management (ITAM)-related activities have the skills and knowledge needed to perform their assigned duties. Assessment rigor: 2 Origin: SCF Created
AST-03 Standardized Naming Convention – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AST-03_A01 a scalable, standardized naming convention exists for systems, applications and services that avoids asset naming conflicts. Assessment rigor: 1 Origin: SCF Created
AST-04 Asset Inventories – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AST-04_A01 a documented, up-to-date, complete, accurate and readily available inventory of systems and system components exists. Assessment rigor: 1 Origin: 172A_3.4.3e[b] 171A_3.4.1[d] 172A_3.4.1e[b] 53A_R5_CM-08a.01 53A_R5_CM-08a.02 53A_R5_CM-08a.05 53A_R5_PM-05[01] AST-04_A02 the system inventory includes hardware, software, firmware and documentation. Assessment rigor: 1 Origin: 171A_3.4.1[e] AST-04_A03 the inventory is maintained (reviewed / updated) throughout the system development life cycle. Defined parameters: at least monthly Assessment rigor: 1 Origin: 171A_3.4.1[f] 53A_R5_CM-08b. AST-04_A04 approved systems and system components are identified. Assessment rigor: 2 Origin: 172A_3.4.1e[a] AST-04_A05 information deemed necessary to achieve effective systems and system component accountability is defined. Assessment rigor: 3 Origin: 53A_R5_CM-08_ODP[01] AST-04_A06 the frequency at which to update the inventory of systems and system components is defined. Defined parameters: at least annually Assessment rigor: 3 Origin: 53A_R5_PM-05_ODP AST-04_A07 the inventory of systems and system components is updated per an organization-defined frequency. Defined parameters: at least annually Assessment rigor: 3 Origin: 53A_R5_PM-05[02] AST-04_A08 the frequency at which to review and update the system component inventory is defined. Defined parameters: at least annually Assessment rigor: 2 Origin: 171A_R3_A.03.04.10.ODP[01] AST-04_A09 an inventory of system components is developed and documented. Assessment rigor: 2 Origin: 171A_R3_A.03.04.10.a AST-04_A10 the system component inventory is reviewed <A.03.04.10.ODP[01]: frequency>. Defined parameters: at least quarterly Assessment rigor: NIST 800-171 Origin: 171A_R3_A.03.04.10.b[01] AST-04_A11 the system component inventory is updated <A.03.04.10.ODP[01]: frequency>. Defined parameters: at least quarterly Assessment rigor: NIST 800-171 Origin: 171A_R3_A.03.04.10.b[02]
AST-04.1 Updates During Installations / Removals – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AST-04.1_A01 the system component inventory is updated as part of component installations. Assessment rigor: 1 Origin: 171A_R3_A.03.04.10.c[01] 53A_R5_CM-08(01)[01] AST-04.1_A02 the system component inventory is updated as part of component removals. Assessment rigor: 1 Origin: 171A_R3_A.03.04.10.c[02] 53A_R5_CM-08(01)[02] AST-04.1_A03 the system component inventory is updated as part of system updates. Assessment rigor: 1 Origin: 171A_R3_A.03.04.10.c[03] 53A_R5_CM-08(01)[03]
AST-04.2 Component Duplication Avoidance – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AST-04.2_A01 an inventory of system components that accurately reflects the system is developed and documented. Assessment rigor: 1 Origin: 53A_R5_CM-08a.01 AST-04.2_A02 an inventory of system components that includes all components within the system is developed and documented. Assessment rigor: 3 Origin: 53A_R5_CM-08a.02 AST-04.2_A03 an inventory of system components that does not include duplicate accounting of components or components assigned to any other system is developed and documented. Assessment rigor: 3 Origin: 53A_R5_CM-08a.03 AST-04.2_A04 an inventory of system components that includes information is developed and documented. Assessment rigor: 3 Origin: 53A_R5_CM-08a.05 AST-04.2_A05 the system component inventory is reviewed / updated frequently. Defined parameters: at least monthly Assessment rigor: 3 Origin: 53A_R5_CM-08b.
AST-05 Identify Critical Assets – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AST-05_A01 systems, applications and services that support essential missions and business functions are identified. Assessment rigor: 1 Origin: 53A_R5_CP-02(03)_ODP[01] 53A_R5_CP-02(05)_ODP 53A_R5_CP-02(06)_ODP 53A_R5_CP-02(08)_ODP AST-05_A02 critical system assets supporting organization-defined criteria mission and business functions are identified. Assessment rigor: 1 Origin: 53A_R5_CP-02(08)
AST-05.1 Technology Assets, Applications, Services and/or Data (TAASD) Criticality Ratings – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AST-05.1_A01 the criteria used to assign Business Continuity & Disaster Recovery (BC/DR)-relevant criticality ratings to Technology Assets, Applications, Services and/or Data (TAASD) are defined. Assessment rigor: 1 Origin: SCF Created AST-05.1_A02 Technology Assets, Applications, Services and/or Data (TAASD) are assigned a Business Continuity & Disaster Recovery (BC/DR)-relevant criticality rating in accordance with the defined criteria. Assessment rigor: 1 Origin: SCF Created AST-05.1_A03 assigned criticality ratings are recorded against Technology Assets, Applications, Services and/or Data (TAASD) entries in the asset inventory or an equivalent register. Assessment rigor: 1 Origin: SCF Created AST-05.1_A04 the frequency at which to review assigned criticality ratings is defined. Defined parameters: at least annually, and upon significant change Assessment rigor: 1 Origin: SCF Created AST-05.1_A05 assigned criticality ratings are reviewed and updated at the defined frequency and when business functions or Technology Assets, Applications, Services and/or Data (TAASD) change. Assessment rigor: 1 Origin: SCF Created
AST-06 Asset-Service Dependencies – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AST-06_A01 asset-service dependencies are identified and documented. Assessment rigor: 1 Origin: SCF Created AST-06_A02 asset-service dependencies are assessed to evaluate cybersecurity / data privacy concerns for technology assets that support more than one critical business function. Assessment rigor: 1 Origin: SCF Created
AST-07 Stakeholder Identification & Involvement – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AST-07_A01 pertinent stakeholders of critical systems, applications and services are identified and documented. Assessment rigor: 1 Origin: SCF Created AST-07_A02 pertinent stakeholders of critical systems, applications and services are involved in supporting the ongoing secure management of those assets. Assessment rigor: 1 Origin: SCF Created
AST-07.1 Technology Assets, Applications, Services and/or Data (TAASD) Ownership Assignment – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AST-07.1_A01 the name, position and/or role of the team, individual or responsible organization assigned ownership of Technology Assets, Applications, Services and/or Data (TAASD) is documented. Assessment rigor: 1 Origin: 53A_R5_CM-08(04)_ODP AST-07.1_A02 Technology Assets, Applications, Services and/or Data (TAASD) ownership assignments are tracked and updated when ownership changes. Assessment rigor: 2 Origin: SCF Created
AST-07.2 Accountability Information – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AST-07.2_A01 the name, position and/or role of individuals responsible/accountable for administering assets is formally documented as part of the technology asset inventory. Assessment rigor: 1 Origin: 53A_R5_CM-08(04)
AST-08 Comprehensive Asset Inventory Management – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AST-08_A01 an inventory of Technology Assets, Applications, Services and/or Data (TAASD) is maintained and is dynamically updated as assets are added, changed or removed. Assessment rigor: 2 Origin: SCF Created AST-08_A02 the contextual attributes to be captured for each inventoried Technology Asset, Application, Service and/or Data (TAASD) entry (e.g., owner, location, criticality, data sensitivity, dependencies, software and configuration details) are defined and populated. Assessment rigor: 1 Origin: SCF Created AST-08_A03 inventory data is used to detect anomalies, including unknown, unexpected or non-conforming assets. Assessment rigor: 1 Origin: SCF Created AST-08_A04 inventory data is used to manage vulnerabilities, including identifying affected assets and prioritizing remediation. Assessment rigor: 1 Origin: SCF Created AST-08_A05 inventory data is used to maintain compliance, including determining which assets are within the scope of statutory, regulatory and/or contractual obligations. Assessment rigor: 1 Origin: SCF Created AST-08_A06 inventory data is used to maintain resilient capabilities, including identifying the assets that support business-critical functions and their recovery. Assessment rigor: 1 Origin: SCF Created
AST-08.1 Configuration Management Database (CMDB) – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AST-08.1_A01 a centralized repository for the system and system component inventory is provided. Assessment rigor: 1 Origin: 53A_R5_CM-08(07) AST-08.1_A02 automated mechanisms used to maintain the currency of the system component inventory are defined. Assessment rigor: 2 Origin: 53A_R5_CM-08(02)_ODP[01] 53A_R5_CM-08(02)[01] AST-08.1_A03 automated mechanisms used to maintain the completeness of the system component inventory are defined. Assessment rigor: 2 Origin: 53A_R5_CM-08(02)_ODP[02] 53A_R5_CM-08(02)[02] AST-08.1_A04 automated mechanisms used to maintain the accuracy of the system component inventory are defined. Assessment rigor: 2 Origin: 53A_R5_CM-08(02)_ODP[03] 53A_R5_CM-08(02)[03] AST-08.1_A05 automated mechanisms used to maintain the availability of the system component inventory are defined. Assessment rigor: 3 Origin: 53A_R5_CM-08(02)_ODP[04] 53A_R5_CM-08(02)[04]
AST-08.2 Component Assignment – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AST-08.2_A01 personnel or roles from which to receive an acknowledgement is/are defined. Assessment rigor: 1 Origin: 53A_R5_CM-08(09)_ODP AST-08.2_A02 system components are assigned to a system. Assessment rigor: 1 Origin: 53A_R5_CM-08(09)(a) AST-08.2_A03 an acknowledgement of the component assignment is received from organization-defined personnel or roles. Assessment rigor: 3 Origin: 53A_R5_CM-08(09)(b)
AST-09 Asset Discovery – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AST-09_A01 automated asset discovery tools are deployed to identify Technology Assets, Applications and/or Services (TAAS) connected to organizational networks. Assessment rigor: 1 Origin: SCF Created AST-09_A02 the frequency at which automated asset discovery is performed is defined. Defined parameters: at least weekly Assessment rigor: 3 Origin: SCF Created AST-09_A03 the network scope covered by automated asset discovery is defined and includes all organizational network segments (e.g., wired, wireless, cloud and remote access). Assessment rigor: 1 Origin: SCF Created AST-09_A04 discovered Technology Assets, Applications and/or Services (TAAS) are compared against existing inventories to identify assets not present in the inventory. Assessment rigor: 1 Origin: SCF Created AST-09_A05 assets identified by discovery that are not present in existing inventories are investigated and either added to the inventory or removed from the network within a defined time period. Defined parameters: within one (1) week of discovery Assessment rigor: 2 Origin: SCF Created
AST-09.1 Dynamic Host Configuration Protocol (DHCP) Server Logging – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AST-09.1_A01 Dynamic Host Configuration Protocol (DHCP) server logging is implemented. Assessment rigor: 1 Origin: SCF Created AST-09.1_A02 DHCP server logging is utilized to detect unknown systems. Assessment rigor: 1 Origin: SCF Created AST-09.1_A03 Dynamic Host Configuration Protocol (DHCP) server logs are used to improve asset inventories. Assessment rigor: 1 Origin: SCF Created AST-09.1_A04 Dynamic Host Configuration Protocol (DHCP) server logs are retained and available to support troubleshooting or forensic analysis activities. Assessment rigor: 1 Origin: SCF Created
AST-09.2 Automated Network Asset Discovery – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AST-09.2_A01 Software Defined Networking (SDN), or similar technologies, analyzes network traffic to identify devices. Assessment rigor: 1 Origin: SCF Created AST-09.2_A02 Software Defined Networking (SDN), or similar technologies, analyzes network traffic to document devices. Assessment rigor: 1 Origin: SCF Created AST-09.2_A03 Software Defined Networking (SDN), or similar technologies, analyzes network traffic to track devices. Assessment rigor: 1 Origin: SCF Created
AST-09.3 Automated Location Tracking – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AST-09.3_A01 automated mechanisms for tracking components are defined. Assessment rigor: 1 Origin: 53A_R5_CM-08(08)_ODP AST-09.3_A02 organization-defined automated mechanisms are used to support the tracking of system components by geographic location. Assessment rigor: 3 Origin: 53A_R5_CM-08(08)
AST-10 Approved Technologies – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AST-10_A01 the list of authorized software programs is reviewed / updated per an organization-defined frequency. Defined parameters: at least annually Assessment rigor: 1 Origin: SCF Created AST-10_A02 the list of authorized software programs is reviewed and updated <A.03.04.08.ODP[01]: frequency>. Defined parameters: at least quarterly Assessment rigor: NIST 800-171 Origin: 171A_R3_A.03.04.08.c
AST-10.1 Authorized To Connect – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AST-10.1_A01 Technology Assets, Applications and/or Services (TAAS) that are authorized to connect to organizational Technology Assets, Applications, Services and/or Data (TAASD) are identified. Assessment rigor: 1 Origin: SCF Created AST-10.1_A02 Identity & Access Management (IAM) personnel maintain a list of TAAS that are authorized to connect to organizational TAASD. Assessment rigor: 1 Origin: SCF Created
AST-11 Automated Unauthorized Component Detection – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AST-11_A01 automated mechanisms used to detect the presence of unauthorized hardware within the system are defined. Defined parameters: automated mechanisms with a maximum five-minute delay in detection Assessment rigor: 1 Origin: 53A_R5_CM-08(03)_ODP[01] 53A_R5_CM-08(03)_ODP[02] 53A_R5_CM-08(03)_ODP[03] 53A_R5_CM-08(03)(a)[01] 53A_R5_CM-08(03)(a)[02] 53A_R5_CM-08(03)(a)[03] AST-11_A02 the frequency at which automated mechanisms are used to detect the presence of unauthorized hardware, software and/or firmware within the system is defined. Defined parameters: automated mechanisms with a maximum five-minute delay in detection Assessment rigor: 1 Origin: 53A_R5_CM-08(03)_ODP[04] AST-11_A03 automated mechanisms disable network access by unauthorized components, isolate unauthorized components and/or notify organization-defined personnel or roles. Assessment rigor: 2 Origin: 53A_R5_CM-08(03)_ODP[05] AST-11_A04 personnel or roles to be notified when unauthorized components are detected is/are defined. Assessment rigor: 3 Origin: 53A_R5_CM-08(03)_ODP[06] AST-11_A05 organization-defined actions are taken when unauthorized hardware, software and/or firmware is/are detected. Assessment rigor: 3 Origin: 53A_R5_CM-08(03)(b)[01] 53A_R5_CM-08(03)(b)[02] 53A_R5_CM-08(03)(b)[03]
AST-12 Prohibited Technology Assets, Applications and/or Services (TAAS) – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AST-12_A01 Supply Chain Risk Management (SCRM) practices require the removal and prohibition of Technology Assets, Applications and/or Services (TAAS) that are designated as supply chain threats by a statutory or regulatory body. Defined parameters: the removal timeframe specified by the applicable statutory or regulatory designation, and no longer than the shortest applicable compliance deadline Assessment rigor: 1 Origin: SCF Created AST-12_A02 Supply Chain Risk Management (SCRM) practices require the removal and prohibition of Technology Assets, Applications and/or Services (TAAS) that are designated as supply chain threats by an internally performed risk assessment. Assessment rigor: 1 Origin: SCF Created
AST-13 Software Licensing Restrictions – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AST-13_A01 administrative practices identify software licensing restrictions needed for compliance with End User Licensing Agreements (EULAs). Assessment rigor: 1 Origin: SCF Created AST-13_A02 software inventories are reviewed, through automated or manual means, for software licensing compliance per an organization-defined frequency. Defined parameters: at least annually Assessment rigor: 1 Origin: SCF Created
AST-14 Provenance – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AST-14_A01 systems, system components and associated data that require valid provenance are defined. Assessment rigor: 1 Origin: 53A_R5_SR-04_ODP AST-14_A02 valid provenance is documented for systems, system components and associated data. Assessment rigor: 1 Origin: 53A_R5_SR-04[01] AST-14_A03 valid provenance is monitored for systems, system components and associated data. Assessment rigor: 3 Origin: 53A_R5_SR-04[02] AST-14_A04 valid provenance is maintained for systems, system components and associated data. Assessment rigor: 3 Origin: 53A_R5_SR-04[03] AST-14_A05 supply chain elements, processes and personnel associated with systems and critical system components that require unique identification are defined. Assessment rigor: 3 Origin: 53A_R5_SR-04(01)_ODP AST-14_A06 unique identification of supply chain elements, processes and personnel is established. Assessment rigor: 3 Origin: 53A_R5_SR-04(01)[01] AST-14_A07 unique identification of supply chain elements, processes and personnel is maintained. Assessment rigor: 3 Origin: 53A_R5_SR-04(01)[02] AST-14_A08 systems and critical system components that require unique identification for tracking through the supply chain are defined. Assessment rigor: 3 Origin: 53A_R5_SR-04(02)_ODP AST-14_A09 the unique identification of systems and critical system components is established for tracking through the supply chain. Assessment rigor: 3 Origin: 53A_R5_SR-04(02)[01] AST-14_A10 the unique identification of systems and critical system components is maintained for tracking through the supply chain. Assessment rigor: 3 Origin: 53A_R5_SR-04(02)[02]
AST-15 Asset Categorization – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AST-15_A01 the organization utilizes a defined methodology to categorize its technology assets based on data sensitivity and criticality. Assessment rigor: 1 Origin: SCF Created
AST-15.1 High-Risk Technology Assets, Applications and/or Services (TAAS) Categorization – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AST-15.1_A01 Technology Assets, Applications and/or Services (TAAS) are categorized as "High Risk" if they pose a significant risk of harm to an individual's health. Assessment rigor: 1 Origin: SCF Created AST-15.1_A02 Technology Assets, Applications and/or Services (TAAS) are categorized as "High Risk" if they pose a significant risk of harm to an individual's safety. Assessment rigor: 1 Origin: SCF Created AST-15.1_A03 Technology Assets, Applications and/or Services (TAAS) are categorized as "High Risk" if they pose a significant risk of harm to an individual's fundamental human rights. Assessment rigor: 1 Origin: SCF Created
AST-15.2 Categorize Artificial Intelligence (AI)-Related Technology Assets, Applications and/or Services (TAAS) – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AST-15.2_A01 a defined methodology is used to categorize Artificial Intelligence (AI)-enabled Technology Assets, Applications and/or Services (TAAS) based on data sensitivity and criticality. Assessment rigor: 1 Origin: SCF Created
AST-15.3 Asset Attributes – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AST-15.3_A01 a capability exists to dynamically associate asset-specific attributes to enable Attribute-Based Access Control (ABAC). Assessment rigor: 1 Origin: SCF Created
AST-16 Asset Scope Classification – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AST-16_A01 system hardware components to be marked indicating the impact level or classification level of the information permitted to be processed, stored, or transmitted by the hardware component are defined. Assessment rigor: 1 Origin: 53A_R5_PE-22_ODP AST-16_A02 system hardware components are marked indicating the impact level or classification level of the information permitted to be processed, stored, or transmitted by the hardware component. Assessment rigor: 1 Origin: 53A_R5_PE-22
AST-16.1 Compliance-Specific Asset Identification – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AST-16.1_A01 an inventory of systems, applications and services exists for each statutory, regulatory and/or contractual compliance obligation and provides sufficient detail to determine control applicability, based on asset scope categorization. Assessment rigor: 1 Origin: SCF Created AST-16.1_A02 inventories of systems, applications and services are reviewed and updated per an organization-defined frequency for each statutory, regulatory and/or contractual compliance obligation, providing sufficient detail to determine control applicability, based on asset scope categorization. Defined parameters: at least annually Assessment rigor: 1 Origin: SCF Created
AST-17 Network Diagrams & Data Flow Diagrams (DFDs) – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AST-17_A01 sensitive / regulated data flows are identified and documented. Assessment rigor: 1 Origin: SCF Created AST-17_A02 a Data Flow Diagram (DFD) exists for each type of sensitive / regulated data that is stored, processed and/or transmitted. Assessment rigor: 1 Origin: SCF Created AST-17_A03 a process exists to review DFDs for accuracy per an organization-defined frequency. Defined parameters: at least annually Assessment rigor: 1 Origin: SCF Created AST-17_A04 a process exists to update DFDs upon technology or business practice changes that affect where sensitive / regulated data is stored, processed and/or transmitted. Assessment rigor: 1 Origin: SCF Created AST-17_A05 one or more high-level network diagrams exist as a schematic to identify the logical placement of systems, applications and services at a conceptual level. Assessment rigor: 2 Origin: SCF Created AST-17_A06 one or more low-level network diagrams exist as a schematic to identify the detailed logical and physical placement of systems, applications and services. Assessment rigor: 2 Origin: SCF Created AST-17_A07 a process exists to review network diagrams for accuracy per an organization-defined frequency. Defined parameters: at least annually Assessment rigor: 3 Origin: SCF Created AST-17_A08 a process exists to update network diagrams upon changes to technologies. Assessment rigor: 2 Origin: SCF Created
AST-17.1 Control Applicability Boundary Graphical Representation – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AST-17.1_A01 one or more diagrams graphically depict control applicability boundaries for systems, applications, services and third parties to clarify "in-scope versus out-of-scope" determinations. Assessment rigor: 1 Origin: SCF Created
AST-17.2 Data Action Mapping – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AST-17.2_A01 a map of system data actions is developed and documented. Assessment rigor: 1 Origin: 53A_R5_CM-13 AST-17.2_A02 the location of sensitive / regulated data is identified and documented. Assessment rigor: 1 Origin: SCF Created AST-17.2_A03 the system components on which sensitive / regulated data is processed are identified and documented. Assessment rigor: 1 Origin: SCF Created AST-17.2_A04 the system components on which sensitive / regulated data is stored are identified and documented. Assessment rigor: 1 Origin: SCF Created AST-17.2_A05 changes to the system or system component location where sensitive / regulated data is processed are documented. Assessment rigor: 1 Origin: SCF Created AST-17.2_A06 changes to the system or system component location where sensitive / regulated data is stored are documented. Assessment rigor: 1 Origin: SCF Created AST-17.2_A07 the location of CUI is identified and documented. Assessment rigor: NIST 800-171 Origin: 171A_R3_A.03.04.11.a[01] AST-17.2_A08 the system components on which CUI is processed are identified and documented. Assessment rigor: NIST 800-171 Origin: 171A_R3_A.03.04.11.a[02] AST-17.2_A09 the system components on which CUI is stored are identified and documented. Assessment rigor: NIST 800-171 Origin: 171A_R3_A.03.04.11.a[03] AST-17.2_A10 changes to the system or system component location where CUI is processed are documented. Assessment rigor: NIST 800-171 Origin: 171A_R3_A.03.04.11.b[01] AST-17.2_A11 changes to the system or system component location where CUI is stored are documented. Assessment rigor: NIST 800-171 Origin: 171A_R3_A.03.04.11.b[02]
AST-18 Security of Assets & Media – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AST-18_A01 strict control is maintained over the internal or external distribution of any kind of sensitive / regulated media. Assessment rigor: 1 Origin: SCF Created
AST-18.1 Management Approval For External Media Transfer – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AST-18.1_A01 written management approval is obtained prior to the transfer of any sensitive / regulated media outside of the organization's facilities. Assessment rigor: 1 Origin: SCF Created
AST-19 Technology Assets, Applications, Services and/or Data (TAASD) Storage – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AST-19_A01 the physical security protections required for rooms and/or facilities used to store Technology Assets, Applications, Services and/or Data (TAASD) are defined. Assessment rigor: 1 Origin: SCF Created AST-19_A02 processes exist to define criteria for Technology Assets, Applications, Services and/or Data (TAASD) storage. Assessment rigor: 1 Origin: SCF Created AST-19_A03 Technology Assets, Applications, Services and/or Data (TAASD) are stored in rooms and/or facilities that implement the organization-defined physical security protections. Assessment rigor: 1 Origin: SCF Created
AST-19.1 Temporary Asset Storage In Automobiles – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AST-19.1_A01 users are educated on the need to physically secure laptops and other mobile devices out of sight when traveling, preferably in the trunk of a vehicle. Assessment rigor: 1 Origin: SCF Created
AST-20 Unattended End-User Equipment – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AST-20_A01 enhanced protection measures for unattended systems are implemented to protect against tampering and unauthorized access. Assessment rigor: 1 Origin: SCF Created
AST-21 Kiosks & Point of Interaction (PoI) Devices – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AST-21_A01 devices that capture sensitive / regulated data via direct physical interaction are protected from tampering and substitution. Assessment rigor: 1 Origin: SCF Created
AST-22 Secure Disposal, Destruction or Re-Use of Equipment – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AST-22_A01 technology assets to be securely disposed of, destroyed or repurposed are defined. Assessment rigor: 1 Origin: 53A_R5_SR-12_ODP[01] 53A_R5_MP-06_ODP[01] 53A_R5_MP-06_ODP[02] 53A_R5_MP-06_ODP[03] AST-22_A02 techniques and methods for securely disposing of, destroying or repurposing technology assets are defined. Assessment rigor: 1 Origin: 53A_R5_SR-12_ODP[02] 53A_R5_MP-06_ODP[04] 53A_R5_MP-06_ODP[05] 53A_R5_MP-06_ODP[06] AST-22_A03 technology assets are securely disposed of, destroyed or repurposed using the defined techniques and methods. Assessment rigor: 1 Origin: 53A_R5_SR-12 AST-22_A04 digital media is sanitized using sanitization techniques and procedures prior to disposal. Defined parameters: techniques and procedures IAW NIST SP 800-088 Section 4: Reuse and Disposal of Storage Media and Hardware Assessment rigor: 1 Origin: 53A_R5_MP-06a.[01] AST-22_A05 digital media is sanitized using sanitization techniques and procedures prior to release from organizational control. Defined parameters: techniques and procedures IAW NIST SP 800-088 Section 4: Reuse and Disposal of Storage Media and Hardware Assessment rigor: 3 Origin: 53A_R5_MP-06a.[02] AST-22_A06 digital media is sanitized using sanitization techniques and procedures prior to release for reuse. Defined parameters: techniques and procedures IAW NIST SP 800-088 Section 4: Reuse and Disposal of Storage Media and Hardware Assessment rigor: 3 Origin: 53A_R5_MP-06a.[03] AST-22_A07 sanitization mechanisms with strength and integrity commensurate with the security category or classification of the information are employed. Assessment rigor: 3 Origin: 53A_R5_MP-06b. AST-22_A08 disposal, destruction and repurposing techniques and methods prevent technology asset components from being resold, redistributed and/or reused through unauthorized channels. Assessment rigor: 1 Origin: SCF Created
AST-23 Return of Assets – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AST-23_A01 the organization governs a process by which employees return all organizational assets in their possession within an organization-defined period following termination of employment. Defined parameters: no more than 5 business days following termination Assessment rigor: 1 Origin: SCF Created AST-23_A02 the organization governs a process by which third-party users return all organizational assets in their possession within an organization-defined period following termination of the contract or agreement. Defined parameters: no more than 5 business days following termination of the contract or agreement Assessment rigor: 1 Origin: SCF Created AST-23_A03 upon termination of individual employment, security-related system property is retrieved. Assessment rigor: 2 Origin: 171A_R3_A.03.09.02.a.03
AST-24 Removal of Assets – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AST-24_A01 facility egress points are controlled by physical security measures. Assessment rigor: 2 Origin: SCF Created AST-24_A02 prior management authorization is required for the removal of technology assets from organizational facilities. Assessment rigor: 1 Origin: SCF Created AST-24_A03 the organization tracks technology assets entering and exiting organizational facilities. Assessment rigor: 1 Origin: SCF Created
AST-25 Use of Personal Devices – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AST-25_A01 the possession of personally-owned technology devices is restricted within organization-controlled facilities. Assessment rigor: 1 Origin: SCF Created AST-25_A02 the usage of personally-owned technology devices is restricted within organization-controlled facilities. Assessment rigor: 1 Origin: SCF Created
AST-26 Use of Third-Party Devices – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AST-26_A01 technology configurations prohibit third-party technology assets from connecting to the organization's internal network(s). Assessment rigor: 1 Origin: SCF Created AST-26_A02 third-party assets connected to the network are restricted from accessing unauthorized resources within the organization. Assessment rigor: 1 Origin: SCF Created AST-26_A03 third-party assets connected to the network are restricted from exfiltrating organizational data. Assessment rigor: 1 Origin: SCF Created
AST-27 Bring Your Own Device (BYOD) Usage – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AST-27_A01 a Bring Your Own Device (BYOD) program is implemented and governed to reduce risk associated with personally-owned devices in the workplace. Assessment rigor: 1 Origin: SCF Created
AST-28 Usage Parameters – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AST-28_A01 the components for which usage restrictions and implementation guidance are to be established are defined. Assessment rigor: 1 Origin: 53A_R5_SC-43_ODP AST-28_A02 usage restrictions and implementation guidelines are established for components. Assessment rigor: 1 Origin: 53A_R5_SC-43a. AST-28_A03 the use of components is authorized within the system. Assessment rigor: 3 Origin: 53A_R5_SC-43b.[01] AST-28_A04 the use of components is monitored within the system. Assessment rigor: 3 Origin: 53A_R5_SC-43b.[02] AST-28_A05 the use of components is controlled within the system. Assessment rigor: 3 Origin: 53A_R5_SC-43b.[03]
AST-29 Technology Asset Inspections – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AST-29_A01 systems or system components that require inspection are defined. Assessment rigor: 1 Origin: 53A_R5_SR-10_ODP[01] AST-29_A02 the frequency at which to inspect systems or system components is defined. Defined parameters: at least annually Assessment rigor: 1 Origin: 53A_R5_SR-10_ODP[02] 53A_R5_SR-10_ODP[03] AST-29_A03 indications of the need for an inspection of systems or system components are defined. Assessment rigor: 1 Origin: 53A_R5_SR-10_ODP[04] AST-29_A04 systems or system components are inspected to detect tampering. Assessment rigor: 1 Origin: 53A_R5_SR-10
AST-29.1 Physical Tampering Detection – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AST-29.1_A01 mobile devices are inspected for evidence of tampering upon return from geographic regions of concern or other known hostile environments that could lead to device compromise. Assessment rigor: 1 Origin: SCF Created AST-29.1_A02 mobile devices that show signs of tampering are confiscated for forensic examination. Assessment rigor: 1 Origin: SCF Created
AST-29.2 Logical Tampering Protection – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AST-29.2_A01 a tamper protection program is implemented for the system, system component or system service. Assessment rigor: 1 Origin: 53A_R5_SR-09 AST-29.2_A02 anti-tamper technologies, tools and techniques are employed throughout the system development life cycle. Assessment rigor: 1 Origin: 53A_R5_SR-09(01)
AST-30 Roots of Trust Protection – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AST-30_A01 security-critical or essential software is defined. Assessment rigor: 1 Origin: 172A_3.14.1e_ODP[1] AST-30_A02 root of trust mechanisms or cryptographic signatures are identified. Assessment rigor: 1 Origin: 172A_3.14.1e[a] AST-30_A03 the integrity of security critical or essential software is verified using root of trust mechanisms or cryptographic signatures. Assessment rigor: 1 Origin: 172A_3.14.1e[b]
AST-31 Telecommunications Equipment – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AST-31_A01 usage restrictions and implementation guidance for telecommunication equipment are established to prevent potential damage. Assessment rigor: 1 Origin: SCF Created AST-31_A02 usage restrictions and implementation guidance for telecommunication equipment are established to prevent unauthorized modification. Assessment rigor: 1 Origin: SCF Created AST-31_A03 usage restrictions and implementation guidance for telecommunication equipment are established to prevent potential eavesdropping. Assessment rigor: 1 Origin: SCF Created
AST-32 Travel-Only Devices – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AST-32_A01 the organization maintains a pool of temporary, loaner or "travel-only" end user technology (e.g., laptops and mobile devices). Assessment rigor: 1 Origin: SCF Created AST-32_A02 personnel travelling overseas request and are issued temporary, loaner or "travel-only" end user technology (e.g., laptops and mobile devices) when travelling to authoritarian countries with a higher-than-average risk for Intellectual Property (IP) theft or espionage against individuals and private companies. Assessment rigor: 1 Origin: SCF Created AST-32_A03 systems or system components with organization-defined configurations are issued to individuals traveling to high-risk locations. Defined parameters: at a minimum, a hardened build with full-disk encryption enabled and no sensitive organizational data stored on the device Assessment rigor: 3 Origin: SCF Created AST-32_A04 systems or system components with the following configurations are issued to individuals traveling to high-risk locations: <A.03.04.12.ODP[01]: configurations>. Defined parameters: a configuration that has no CUI or FCI stored on the system and prevents the processing, storing, and transmission of CUI and FCI, unless a specific exception is granted in writing by the Contracting Officer Assessment rigor: NIST 800-171 Origin: 171A_R3_A.03.04.12.a
AST-33 Re-Imaging Devices After Travel – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AST-33_A01 upon return from travel to authoritarian countries, the issued temporary, loaner or "travel-only" end user technology (e.g., laptops and mobile devices) is wiped / re-imaged before being re-issued. Assessment rigor: 1 Origin: SCF Created AST-33_A02 organization-defined security requirements are applied to the system or system components when the individuals return from travel. Defined parameters: at a minimum, re-imaging from a known-good baseline before the device is reconnected to an internal network or re-issued Assessment rigor: 3 Origin: SCF Created AST-33_A03 the following security requirements are applied to the system or system components when the individuals return from travel: <A.03.04.12.ODP[02]: security requirements>. Defined parameters: examine the system for signs of physical tampering and take the appropriate actions, and then either purge and reimage all storage media or destroy the system Assessment rigor: NIST 800-171 Origin: 171A_R3_A.03.04.12.b
AST-34 Jump Server – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AST-34_A01 a "jump box" or "jump server" is established in a secure network zone that is separate from user workstations. Assessment rigor: 1 Origin: SCF Created AST-34_A02 non-console system administrative functions are performed only through a "jump box" or "jump server" that is located in a network zone separate from user workstations. Assessment rigor: 1 Origin: SCF Created
AST-35 Database Management System (DBMS) – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AST-35_A01 Database Management Systems (DBMSs) are implemented and maintained. Assessment rigor: 1 Origin: SCF Created
AST-36 Decommissioning – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AST-36_A01 Technology Assets, Applications and/or Services (TAAS) are decommissioned so that data is transitioned to new systems or archived in accordance with applicable organizational standards, as well as statutory, regulatory and contractual obligations. Assessment rigor: 1 Origin: SCF Created AST-36_A02 hard drives from decommissioned Technology Assets, Applications and/or Services (TAAS) are either destroyed or erased in accordance with applicable organizational standards, as well as statutory, regulatory and contractual obligations. Assessment rigor: 1 Origin: SCF Created
AST-37 Technology Lifecycle Management – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AST-37_A01 a technology refresh schedule is planned for the system throughout the system development life cycle. Assessment rigor: 1 Origin: 53A_R5_SA-03(03)[01] AST-37_A02 a technology refresh schedule is implemented for the system throughout the system development life cycle. Assessment rigor: 1 Origin: 53A_R5_SA-03(03)[02] AST-37_A03 system pre-production environments are protected commensurate with risk throughout the system development life cycle for the system, system component or system service. Assessment rigor: 3 Origin: 53A_R5_SA-03(01)
AST-37.1 Stable Versions – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AST-37.1_A01 the latest stable version of software and/or security-related updates is installed on applicable systems. Assessment rigor: 1 Origin: SCF Created
AST-37.2 Removal of Previous Versions – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AST-37.2_A01 software and firmware components to be removed after updated versions have been installed are defined. Assessment rigor: 1 Origin: 53A_R5_SI-02(06)_ODP AST-37.2_A02 previous versions of software and firmware components are removed after updated versions have been installed. Assessment rigor: 1 Origin: 53A_R5_SI-02(06)
AST-38 Technical Debt Reviews – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AST-38_A01 “technical debt” reviews of hardware and software technologies are routinely conducted. Defined parameters: at least annually Assessment rigor: 1 Origin: SCF Created AST-38_A02 the results of “technical debt” reviews are leveraged as justification to remediate outdated and/or unsupported technologies. Assessment rigor: 1 Origin: SCF Created
AST-39 Unsupported Technology Assets, Applications and/or Services (TAAS) – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AST-39_A01 support from external providers is defined. Assessment rigor: 1 Origin: 53A_R5_SA-22_ODP[01] 53A_R5_SA-22_ODP[02] AST-39_A02 system components are replaced when support for the components is no longer available from the developer, vendor, or manufacturer. Assessment rigor: 1 Origin: 53A_R5_SA-22a. 171A_R3_A.03.16.02.a
AST-39.1 Alternate Sources for Continued Support – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AST-39.1_A01 options for risk mitigation or alternative sources for continued support for unsupported components that cannot be replaced are provided. Assessment rigor: 1 Origin: 53A_R5_SA-22b. 171A_R3_A.03.16.02.b
AST-40 Predictable Failure Analysis – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: AST-40_A01 system components for which Mean Time to Failure (MTTF) should be determined are defined. Assessment rigor: 1 Origin: 53A_R5_SI-13_ODP[01] AST-40_A02 Mean Time to Failure (MTTF) substitution criteria to be used as a means to exchange active and standby components are defined. Assessment rigor: 1 Origin: 53A_R5_SI-13_ODP[02] AST-40_A03 Mean Time to Failure (MTTF) is determined for system components in specific environments of operation. Assessment rigor: 1 Origin: 53A_R5_SI-13a. AST-40_A04 substitute system components and a means to exchange active and standby components are provided in accordance with Mean Time to Failure (MTTF) substitution criteria. Assessment rigor: 1 Origin: 53A_R5_SI-13b.
BCD-01 Business Continuity & Disaster Recovery Policy – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: BCD-01_A01 a formal, documented Business Continuity and Disaster Recovery (BC/DR) policy is approved by executive management, or a formally delegated authority, and conveys executive management's intent for Business Continuity and Disaster Recovery (BC/DR). Assessment rigor: 1 Origin: SCF Created BCD-01_A02 the Business Continuity and Disaster Recovery (BC/DR) policy provides organizational direction and states the behaviors expected of personnel and other applicable parties with respect to Business Continuity and Disaster Recovery (BC/DR). Assessment rigor: 1 Origin: SCF Created BCD-01_A03 the current version of the Business Continuity and Disaster Recovery (BC/DR) policy is communicated to, and accessible by, the personnel and other applicable parties who are expected to comply with it. Assessment rigor: 1 Origin: SCF Created BCD-01_A04 the Business Continuity and Disaster Recovery (BC/DR) policy is reviewed at least annually. Defined parameters: at least annually Assessment rigor: 1 Origin: SCF Created BCD-01_A05 the Business Continuity and Disaster Recovery (BC/DR) policy is updated, as necessary, in response to changes in risks, threats, business practices and/or statutory, regulatory and contractual obligations that affect the organization. Assessment rigor: 1 Origin: SCF Created
BCD-02 Business Continuity Management System (BCMS) – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: BCD-02_A01 cybersecurity issues are addressed in the development of a critical infrastructure and key resources protection plan. Assessment rigor: 2 Origin: 53A_R5_PM-08[01] BCD-02_A02 privacy issues are addressed in the development of a critical infrastructure and key resources protection plan. Assessment rigor: 2 Origin: 53A_R5_PM-08[04] BCD-02_A03 cybersecurity issues are addressed in the documentation of a critical infrastructure and key resources protection plan. Assessment rigor: 3 Origin: 53A_R5_PM-08[02] BCD-02_A04 privacy issues are addressed in the documentation of a critical infrastructure and key resources protection plan. Assessment rigor: 3 Origin: 53A_R5_PM-08[05] BCD-02_A05 cybersecurity issues are addressed in the update of a critical infrastructure and key resources protection plan. Assessment rigor: 3 Origin: 53A_R5_PM-08[03] BCD-02_A06 privacy issues are addressed in the update of a critical infrastructure and key resources protection plan. Assessment rigor: 3 Origin: 53A_R5_PM-08[06] BCD-02_A07 Business Continuity & Disaster Recovery (BC/DR) operations are conducted according to documented policies, standards, procedures and/or other organizational directives. Assessment rigor: 1 Origin: SCF Created BCD-02_A08 resources (e.g., people, processes, technologies, data and/or facilities) identified as necessary to support Business Continuity & Disaster Recovery (BC/DR) operations are allocated. Assessment rigor: 1 Origin: SCF Created BCD-02_A09 responsibility and authority for the performance of Business Continuity & Disaster Recovery (BC/DR)-related activities are assigned to designated personnel. Assessment rigor: 1 Origin: SCF Created BCD-02_A10 personnel performing Business Continuity & Disaster Recovery (BC/DR)-related activities have the skills and knowledge needed to perform their assigned duties. Assessment rigor: 2 Origin: SCF Created BCD-02_A11 a Business Continuity Management System (BCMS) is established with a documented scope that identifies the Technology Assets, Applications, Services and/or Data (TAASD) it covers. Assessment rigor: 1 Origin: SCF Created BCD-02_A12 the Business Continuity Management System (BCMS) addresses the resilience of in-scope Technology Assets, Applications, Services and/or Data (TAASD) during routine operations. Assessment rigor: 1 Origin: SCF Created BCD-02_A13 the Business Continuity Management System (BCMS) addresses the resilience of in-scope Technology Assets, Applications, Services and/or Data (TAASD) during adverse conditions. Assessment rigor: 1 Origin: SCF Created
BCD-02.1 Defined Operational Resilience Requirements – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: BCD-02.1_A01 operational resilience requirements that define controlled and acceptable operation of Technology Assets, Applications, Services and/or Data (TAASD) during routine operations are documented. Assessment rigor: 1 Origin: SCF Created BCD-02.1_A02 operational resilience requirements that define controlled and acceptable operation of Technology Assets, Applications, Services and/or Data (TAASD) during adverse conditions are documented. Assessment rigor: 1 Origin: SCF Created BCD-02.1_A03 operational resilience requirements are approved by the business process owners and/or asset owners responsible for the Technology Assets, Applications, Services and/or Data (TAASD). Assessment rigor: 1 Origin: SCF Created BCD-02.1_A04 the frequency at which to review operational resilience requirements is defined. Defined parameters: at least annually, and upon significant change Assessment rigor: 1 Origin: SCF Created BCD-02.1_A05 operational resilience requirements are reviewed and updated at the defined frequency and when Technology Assets, Applications, Services and/or Data (TAASD) or business needs change. Assessment rigor: 1 Origin: SCF Created
BCD-03 Operational Resilience Capabilities – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: BCD-03_A01 capabilities are implemented to provide operational resilience to unintentional errors. Assessment rigor: 1 Origin: SCF Created BCD-03_A02 capabilities are implemented to provide operational resilience to intentional attack or circumvention. Assessment rigor: 1 Origin: SCF Created
BCD-04 Business Continuity & Disaster Recovery (BC/DR) Plans – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: BCD-04_A01 documented roles and responsibilities exist that direct process owners to establish and maintain formal Business Continuity & Disaster Recovery (BC/DR) plans. Assessment rigor: 1 Origin: SCF Created BCD-04_A02 process owners establish and maintain formal Business Continuity & Disaster Recovery (BC/DR) plans that are accurate, representative of current operations and detailed enough to sustain and/or restore operations under adverse conditions. Defined parameters: at least annually Assessment rigor: 1 Origin: SCF Created
BCD-04.1 Recovery Time / Point Objectives (RTO / RPO) – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: BCD-04.1_A01 time period consistent with Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs) for the recovery of the system is determined. Assessment rigor: 1 Origin: 53A_R5_CP-10_ODP[01] BCD-04.1_A02 the alternate storage site is configured to facilitate recovery operations in accordance with Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs). Assessment rigor: 1 Origin: 53A_R5_CP-06(02)[01] 53A_R5_CP-06(02)[02] BCD-04.1_A03 time period consistent with Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs) for the reconstitution of the system is determined. Assessment rigor: 3 Origin: 53A_R5_CP-10_ODP[02] BCD-04.1_A04 the recovery of the system to a known state is provided within a specified time period after a disruption, compromise or failure. Assessment rigor: 3 Origin: 53A_R5_CP-10[01] BCD-04.1_A05 a reconstitution of the system to a known state is provided within an organization-defined time period after a disruption, compromise or failure. Assessment rigor: 3 Origin: 53A_R5_CP-10[02]
BCD-05 Recovery Operations Criteria – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: BCD-05_A01 criteria that must be met to initiate Business Continuity / Disaster Recovery (BC/DR) plans that facilitate business continuity operations capable of meeting applicable Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs) are defined. Defined parameters: the Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs) established by the organization's Business Impact Analysis (BIA) Assessment rigor: 1 Origin: SCF Created
BCD-06 Recovery Operations Communications – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: BCD-06_A01 internal and external stakeholders requiring notification of recovery activities and progress in restoring operational capabilities are identified. Assessment rigor: 1 Origin: SCF Created BCD-06_A02 based on the type of incident, methods to contact internal and external stakeholders requiring notification of recovery activities and progress in restoring operational capabilities are identified. Assessment rigor: 1 Origin: SCF Created BCD-06_A03 processes exist to communicate the status of recovery activities and progress in restoring operational capabilities to designated internal and external stakeholders. Assessment rigor: 1 Origin: SCF Created
BCD-06.1 Alternate Communications Channels – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: BCD-06.1_A01 alternate communication paths for system operations and operational command and control are defined. Assessment rigor: 1 Origin: 53A_R5_SC-47_ODP BCD-06.1_A02 alternate communication paths are established for system operations and operational command and control. Assessment rigor: 3 Origin: 53A_R5_SC-47 BCD-06.1_A03 the conditions that constitute a designated crisis situation are defined. Assessment rigor: 1 Origin: SCF Created BCD-06.1_A04 alternative decision makers are designated to assume command and control if primary decision makers are unavailable during a designated crisis situation. Assessment rigor: 1 Origin: SCF Created
BCD-07 Ongoing Contingency Planning – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: BCD-07_A01 a contingency plan is developed that identifies essential mission and business functions and associated contingency requirements. Assessment rigor: 1 Origin: 53A_R5_CP-02a.01 BCD-07_A02 personnel or roles to review a contingency plan is/are defined. Assessment rigor: 1 Origin: 53A_R5_CP-02_ODP[01] BCD-07_A03 the contingency plan is updated to address changes to the organization, system or environment of operation. Assessment rigor: 1 Origin: 53A_R5_CP-02e.[01] BCD-07_A04 contingency plan changes are communicated to key contingency personnel. Assessment rigor: 1 Origin: 53A_R5_CP-02f.[01] BCD-07_A05 the contingency plan is updated to address problems encountered during contingency plan implementation, execution or testing. Assessment rigor: 3 Origin: 53A_R5_CP-02e.[02] BCD-07_A06 personnel or roles to approve a contingency plan is/are defined. Assessment rigor: 3 Origin: 53A_R5_CP-02_ODP[02] BCD-07_A07 key contingency personnel (identified by name and/or by role) to whom copies of the contingency plan are distributed are defined. Assessment rigor: 3 Origin: 53A_R5_CP-02_ODP[03] BCD-07_A08 key contingency organizational elements to which copies of the contingency plan are distributed are defined. Assessment rigor: 3 Origin: 53A_R5_CP-02_ODP[04] BCD-07_A09 the frequency of contingency plan review is defined. Defined parameters: at least annually Assessment rigor: 3 Origin: 53A_R5_CP-02_ODP[05] BCD-07_A10 key contingency personnel (identified by name and/or by role) to communicate changes to are defined. Assessment rigor: 3 Origin: 53A_R5_CP-02_ODP[06] BCD-07_A11 key contingency organizational elements to communicate changes to are defined. Assessment rigor: 3 Origin: 53A_R5_CP-02_ODP[07] BCD-07_A12 a contingency plan for the system is developed that provides recovery objectives. Assessment rigor: 3 Origin: 53A_R5_CP-02a.02[01] BCD-07_A13 a contingency plan for the system is developed that provides restoration priorities. Assessment rigor: 3 Origin: 53A_R5_CP-02a.02[02] BCD-07_A14 a contingency plan for the system is developed that provides metrics. Assessment rigor: 3 Origin: 53A_R5_CP-02a.02[03] BCD-07_A15 a contingency plan for the system is developed that addresses contingency roles. Assessment rigor: 3 Origin: 53A_R5_CP-02a.03[01] BCD-07_A16 a contingency plan for the system is developed that addresses contingency responsibilities. Assessment rigor: 3 Origin: 53A_R5_CP-02a.03[02] BCD-07_A17 a contingency plan for the system is developed that addresses assigned individuals with contact information. Assessment rigor: 3 Origin: 53A_R5_CP-02a.03[03] BCD-07_A18 a contingency plan for the system is developed that addresses maintaining essential mission and business functions despite a disruption, compromise or failure of a system, application or service. Assessment rigor: 3 Origin: 53A_R5_CP-02a.04 BCD-07_A19 a contingency plan for the system is developed that addresses eventual, full-system restoration without deterioration of the controls originally planned and implemented. Assessment rigor: 3 Origin: 53A_R5_CP-02a.05 BCD-07_A20 a contingency plan for the system is developed that addresses the sharing of contingency information. Assessment rigor: 3 Origin: 53A_R5_CP-02a.06 BCD-07_A21 a contingency plan for the system is developed that is reviewed by personnel or roles. Assessment rigor: 3 Origin: 53A_R5_CP-02a.07[01] BCD-07_A22 a contingency plan for the system is developed that is approved by personnel or roles. Assessment rigor: 3 Origin: 53A_R5_CP-02a.07[02] BCD-07_A23 copies of the contingency plan are distributed to key contingency personnel. Assessment rigor: 3 Origin: 53A_R5_CP-02b.[01] BCD-07_A24 copies of the contingency plan are distributed to organizational elements. Assessment rigor: 3 Origin: 53A_R5_CP-02b.[02] BCD-07_A25 contingency planning activities are coordinated with incident handling activities. Assessment rigor: 3 Origin: 53A_R5_CP-02c. BCD-07_A26 the contingency plan for the system is reviewed frequently. Defined parameters: at least annually Assessment rigor: 3 Origin: 53A_R5_CP-02d. BCD-07_A27 contingency plan changes are communicated to organizational elements. Assessment rigor: 3 Origin: 53A_R5_CP-02f.[02] BCD-07_A28 lessons learned from contingency plan testing or actual contingency activities are incorporated into contingency testing. Assessment rigor: 3 Origin: 53A_R5_CP-02g.[01] BCD-07_A29 lessons learned from contingency plan training or actual contingency activities are incorporated into contingency testing and training. Assessment rigor: 3 Origin: 53A_R5_CP-02g.[02] BCD-07_A30 the contingency plan is protected from unauthorized disclosure. Assessment rigor: 3 Origin: 53A_R5_CP-02h.[01] BCD-07_A31 the contingency plan is protected from unauthorized modification. Assessment rigor: 3 Origin: 53A_R5_CP-02h.[02]
BCD-07.1 Contingency Planning Components – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: BCD-07.1_A01 the organization identifies components that, if changed, potentially impact the organization's ability to execute contingency plans. Assessment rigor: 1 Origin: SCF Created
BCD-07.2 Contingency Plan Update Notifications – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: BCD-07.2_A01 stakeholders for contingency plans are identified. Assessment rigor: 1 Origin: SCF Created BCD-07.2_A02 stakeholders are informed of changes to contingency plans. Assessment rigor: 1 Origin: SCF Created
BCD-07.3 Coordinate with Related Plans – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: BCD-07.3_A01 contingency plan development is coordinated with organizational elements responsible for related plans. Assessment rigor: 1 Origin: 53A_R5_CP-02(01)
BCD-07.4 Coordinate With External Service Providers – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: BCD-07.4_A01 the contingency plan is coordinated with the contingency plans of external service providers to ensure that organizational resiliency requirements can be satisfied. Assessment rigor: 1 Origin: 53A_R5_CP-02(07)
BCD-08 Resume All Missions & Business Functions – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: BCD-08_A01 the contingency plan activation time period within which to resume all mission and business functions is defined. Defined parameters: Recovery Time Objective (RTO) Assessment rigor: 1 Origin: 53A_R5_CP-02(03)_ODP[02] BCD-08_A02 the resumption of all mission and business functions are planned for within an organization-defined time period of contingency plan activation. Defined parameters: time period defined in service provider and organization SLA Assessment rigor: 1 Origin: 53A_R5_CP-02(03)
BCD-08.1 Continue Essential Mission & Business Functions – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: BCD-08.1_A01 the continuance of organization-defined criteria mission and business functions with minimal or no loss of operational continuity is planned for. Defined parameters: essential mission and business functions Assessment rigor: 1 Origin: 53A_R5_CP-02(05)[01] BCD-08.1_A02 continuity is sustained until full system restoration of primary processing and/or storage sites is performed. Assessment rigor: 2 Origin: 53A_R5_CP-02(05)[02]
BCD-08.2 Resume Essential Missions & Business Functions – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: BCD-08.2_A01 the contingency plan activation time period within which to resume essential mission and business functions is defined. Defined parameters: Recovery Time Objective (RTO) Assessment rigor: 1 Origin: 53A_R5_CP-02(03)_ODP[02] BCD-08.2_A02 the resumption of essential mission and business functions are planned for within an organization-defined time period of contingency plan activation. Defined parameters: Recovery Time Objective (RTO) Assessment rigor: 1 Origin: 53A_R5_CP-02(03)
BCD-09 Contingency Training – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: BCD-09_A01 the time period within which to provide contingency training after assuming a contingency role or responsibility is defined. Defined parameters: within 10 days of assuming a contingency role or responsibility Assessment rigor: 1 Origin: 53A_R5_CP-03_ODP[01] BCD-09_A02 the frequency at which to provide training to system users with a contingency role or responsibility is defined. Defined parameters: at least annually Assessment rigor: 1 Origin: 53A_R5_CP-03_ODP[02] BCD-09_A03 the frequency at which to review / update contingency training content is defined. Defined parameters: at least annually Assessment rigor: 1 Origin: 53A_R5_CP-03_ODP[03] BCD-09_A04 events necessitating review / update of contingency training are defined. Assessment rigor: 3 Origin: 53A_R5_CP-03_ODP[04] BCD-09_A05 contingency training is provided to system users consistent with assigned roles and responsibilities within an organization-defined time period of assuming a contingency role or responsibility. Defined parameters: at least annually Assessment rigor: 3 Origin: 53A_R5_CP-03a.01 BCD-09_A06 contingency training is provided to system users consistent with assigned roles and responsibilities when required by system changes. Defined parameters: at least annually Assessment rigor: 3 Origin: 53A_R5_CP-03a.02 BCD-09_A07 contingency training is provided to system users consistent with assigned roles and responsibilities and frequency thereafter. Defined parameters: at least annually Assessment rigor: 3 Origin: 53A_R5_CP-03a.03 BCD-09_A08 the contingency plan training content is reviewed / updated frequently. Defined parameters: at least annually Assessment rigor: 3 Origin: 53A_R5_CP-03b.[01] BCD-09_A09 the contingency plan training content is reviewed / updated following events. Defined parameters: at least annually Assessment rigor: 3 Origin: 53A_R5_CP-03b.[02]
BCD-09.1 Simulated Events – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: BCD-09.1_A01 simulated events are incorporated into contingency training to facilitate effective response by personnel in crisis situations. Assessment rigor: 1 Origin: 53A_R5_CP-03(01)
BCD-09.2 Automated Training Environments – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: BCD-09.2_A01 mechanisms used in operations are employed to provide a more thorough and realistic contingency training environment. Assessment rigor: 1 Origin: 53A_R5_CP-03(02)
BCD-10 Contingency Plan Testing & Exercises – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: BCD-10_A01 the frequency of testing the contingency plan for the system is defined. Defined parameters: at least annually Assessment rigor: 1 Origin: 53A_R5_CP-04_ODP[01] BCD-10_A02 tests for determining the effectiveness of the contingency plan are defined. Defined parameters: functional exercises Assessment rigor: 1 Origin: 53A_R5_CP-04_ODP[02] BCD-10_A03 tests for determining readiness to execute the contingency plan are defined. Defined parameters: functional exercises Assessment rigor: 1 Origin: 53A_R5_CP-04_ODP[03] BCD-10_A04 the contingency plan for the system is tested frequently. Defined parameters: at least annually Assessment rigor: 1 Origin: 53A_R5_CP-04a.[01] BCD-10_A05 tests are used to determine the effectiveness of the plan. Defined parameters: functional exercises Assessment rigor: 3 Origin: 53A_R5_CP-04a.[02] BCD-10_A06 tests are used to determine the readiness to execute the plan. Defined parameters: functional exercises Assessment rigor: 3 Origin: 53A_R5_CP-04a.[03]
BCD-10.1 Coordinated Testing with Related Plans – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: BCD-10.1_A01 contingency plan testing is coordinated with internal and external parties responsible for related plans. Assessment rigor: 1 Origin: 53A_R5_CP-04(01)
BCD-10.2 Contingency Plan Testing For Alternate Storage & Processing Sites – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: BCD-10.2_A01 the contingency plan is tested at the alternate processing site to familiarize contingency personnel with the facility and available resources. Assessment rigor: 1 Origin: 53A_R5_CP-04(02)(a) BCD-10.2_A02 the contingency plan is tested at the alternate processing site to evaluate the capabilities of the alternate processing site to support contingency operations. Assessment rigor: 1 Origin: 53A_R5_CP-04(02)(b)
BCD-11 Contingency Plan Root Cause Analysis (RCA) & Lessons Learned – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: BCD-11_A01 the contingency plan test results are reviewed. Assessment rigor: 1 Origin: 53A_R5_CP-04b. BCD-11_A02 corrective actions to remediate contingency plan deficiencies are initiated, if needed. Assessment rigor: 1 Origin: 53A_R5_CP-04c.
BCD-12 Alternate Storage Site – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: BCD-12_A01 an alternate storage site is established. Assessment rigor: 1 Origin: 53A_R5_CP-06a.[01] BCD-12_A02 the alternate storage site stores the necessary agreements needed for the recovery of Technology Assets, Applications, Services and/or Data (TAASD). Assessment rigor: 1 Origin: 53A_R5_CP-06a.[02] BCD-12_A03 the alternate storage site provides controls equivalent to that of the primary site. Assessment rigor: 3 Origin: 53A_R5_CP-06b. BCD-12_A04 the location or site of the facility where the system resides is planned considering physical and environmental hazards. Assessment rigor: 3 Origin: 53A_R5_PE-23a. BCD-12_A05 the alternate storage site stores the assets needed for the recovery of Technology Assets, Applications, Services and/or Data (TAASD). Assessment rigor: 1 Origin: SCF Created
BCD-12.1 Separation from Primary Storage Site – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: BCD-12.1_A01 an alternate storage site that is sufficiently separated from the primary storage site is identified to reduce susceptibility to the same threats. Assessment rigor: 1 Origin: 53A_R5_CP-06(01)
BCD-12.2 Primary Storage Site Accessibility – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: BCD-12.2_A01 potential accessibility problems to the alternate storage site in the event of an area-wide disruption or disaster are identified. Assessment rigor: 1 Origin: 53A_R5_CP-06(03)[01] BCD-12.2_A02 explicit mitigation actions to address identified accessibility problems are outlined. Assessment rigor: 3 Origin: 53A_R5_CP-06(03)[02]
BCD-13 Alternate Processing Site – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: BCD-13_A01 system operations for essential mission and business functions are defined. Assessment rigor: 1 Origin: 53A_R5_CP-07_ODP[01] BCD-13_A02 time period consistent with recovery time and recovery point objectives is defined. Assessment rigor: 1 Origin: 53A_R5_CP-07_ODP[02] BCD-13_A03 an alternate processing site, including necessary agreements to permit the transfer and resumption of system operations for essential mission and business functions, is established within an organization-defined time period when the primary processing capabilities are unavailable. Assessment rigor: 1 Origin: 53A_R5_CP-07a. BCD-13_A04 the equipment and supplies required to transfer operations are made available at the alternate processing site or if contracts are in place to support delivery to the site within an organization-specified time period for transfer. Assessment rigor: 3 Origin: 53A_R5_CP-07b.[01] BCD-13_A05 the equipment and supplies required to resume operations are made available at the alternate processing site or if contracts are in place to support delivery to the site within an organization-defined time period for resumption. Assessment rigor: 3 Origin: 53A_R5_CP-07b.[02] BCD-13_A06 controls provided at the alternate processing site are equivalent to those at the primary site. Assessment rigor: 3 Origin: 53A_R5_CP-07c. BCD-13_A07 the location or site of the facility where the system resides is planned considering physical and environmental hazards. Assessment rigor: 3 Origin: 53A_R5_PE-23a. BCD-13_A08 the alternate processing site provides processing capability equivalent to that of the primary site. Assessment rigor: 2 Origin: SCF Created
BCD-13.1 Separation from Primary Processing Site – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: BCD-13.1_A01 an alternate processing site is sufficiently separated from the primary processing site to reduce susceptibility to the same threats is identified. Assessment rigor: 1 Origin: 53A_R5_CP-07(01)
BCD-13.2 Alternate Processing Site Accessibility – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: BCD-13.2_A01 potential accessibility problems to alternate processing sites that would impact mitigation and recovery activities in the event of an area-wide disruption or disaster are identified. Assessment rigor: 1 Origin: 53A_R5_CP-07(02)[01] BCD-13.2_A02 explicit mitigation actions to address identified accessibility problems are outlined. Assessment rigor: 3 Origin: 53A_R5_CP-07(02)[02]
BCD-14 Alternate Site Priority of Service – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: BCD-14_A01 alternate processing site agreements that contain priority-of-service provisions in accordance with availability requirements (including recovery time objectives) are developed. Assessment rigor: 1 Origin: 53A_R5_CP-07(03)
BCD-15 Preparation for Use – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: BCD-15_A01 the alternate processing site is prepared so that the site can serve as the operational site supporting essential mission and business functions. Assessment rigor: 1 Origin: 53A_R5_CP-07(04)
BCD-16 Inability to Return to Primary Site – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: BCD-16_A01 circumstances that preclude returning to the primary processing site are planned for. Assessment rigor: 1 Origin: 53A_R5_CP-07(06)[01] BCD-16_A02 circumstances that preclude returning to the primary processing site are prepared for. Assessment rigor: 3 Origin: 53A_R5_CP-07(06)[02]
BCD-16.1 Personnel Transfer to Alternate Processing / Storage Site – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: BCD-16.1_A01 the transfer of organization-defined criteria mission and business functions to alternate processing and/or storage sites with minimal or no loss of operational continuity is planned for. Assessment rigor: 1 Origin: 53A_R5_CP-02(06)[01] BCD-16.1_A02 operational continuity is sustained until full system restoration at primary processing and/or storage sites. Assessment rigor: 3 Origin: 53A_R5_CP-02(06)[02]
BCD-17 Telecommunications Services Availability – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: BCD-17_A01 alternative communications protocols in support of maintaining continuity of operations are defined. Assessment rigor: 1 Origin: 53A_R5_CP-11_ODP BCD-17_A02 the capability to employ alternative communications protocols are provided in support of maintaining continuity of operations. Assessment rigor: 3 Origin: 53A_R5_CP-11 BCD-17_A03 system operations to be resumed for essential mission and business functions are defined. Assessment rigor: 3 Origin: 53A_R5_CP-08_ODP[01] BCD-17_A04 time period within which to resume essential mission and business functions when the primary telecommunications capabilities are unavailable is defined. Assessment rigor: 3 Origin: 53A_R5_CP-08_ODP[02] BCD-17_A05 alternate telecommunications services, including necessary agreements to permit the resumption of system operations, are established for essential mission and business functions within an organization-defined time period when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage sites. Assessment rigor: 3 Origin: 53A_R5_CP-08 BCD-17_A06 alternate telecommunications services to reduce the likelihood of sharing a single point of failure with primary telecommunications services are obtained. Assessment rigor: 3 Origin: 53A_R5_CP-08(02)
BCD-17.1 Telecommunications Priority of Service Provisions – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: BCD-17.1_A01 primary telecommunications service agreements that contain priority-of-service provisions in accordance with availability requirements (including recovery time objectives) are developed. Assessment rigor: 1 Origin: 53A_R5_CP-08(01)(a)[01] BCD-17.1_A02 alternate telecommunications service agreements that contain priority-of-service provisions in accordance with availability requirements (including recovery time objectives) are developed. Assessment rigor: 3 Origin: 53A_R5_CP-08(01)(a)[02] BCD-17.1_A03 Telecommunications Service Priority is requested for all telecommunications services used for national security emergency preparedness if the primary and/or alternate telecommunications services are provided by a common carrier. Assessment rigor: 3 Origin: 53A_R5_CP-08(01)(b)
BCD-17.2 Separation of Primary / Alternate Providers – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: BCD-17.2_A01 services are obtained from alternative providers that are different from the primary service providers to reduce susceptibility to the same threats. Assessment rigor: 1 Origin: 53A_R5_CP-08(03) BCD-17.2_A02 the services for which alternative providers are to be obtained are defined. Assessment rigor: 1 Origin: SCF Created
BCD-18 Technology Assets, Applications and/or Services (TAAS) Recovery & Reconstitution – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: BCD-18_A01 secure baseline configurations exist for systems, applications and/or services that protect the confidentiality and integrity of data being stored, processed and/or transmitted. Assessment rigor: 1 Origin: SCF Created BCD-18_A02 systems, applications and/or services are securely recovered / reconstituted to a known, trusted state after a disruption, compromise or failure. Assessment rigor: 1 Origin: SCF Created
BCD-18.1 Restore Within Time Period – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: BCD-18.1_A01 Technology Assets, Applications, Services and/or Data (TAASD) are restored to a known, operational state from configuration-controlled and integrity-protected information. Assessment rigor: 1 Origin: 53A_R5_CP-10(04) BCD-18.1_A02 the restoration time period within which to restore Technology Assets, Applications, Services and/or Data (TAASD) to a known, operational state is defined. Defined parameters: a time period consistent with the restoration time periods defined in the service provider and organization Service Level Agreement (SLA) Assessment rigor: 1 Origin: 53A_R5_CP-10(04)_ODP BCD-18.1_A03 Technology Assets, Applications, Services and/or Data (TAASD) are restored to a known, operational state within the organization-defined restoration time period. Assessment rigor: 2 Origin: SCF Created
BCD-18.2 Recovery Images – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: BCD-18.2_A01 assets are reimaged from configuration-controlled images. Assessment rigor: 1 Origin: SCF Created BCD-18.2_A02 images that represent a secure, operational state are integrity-protected. Assessment rigor: 1 Origin: SCF Created
BCD-19 Isolated Recovery Environment – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: BCD-19_A01 the organization utilizes an isolated, non-production environment to perform data backups via offline, cloud or off-site capabilities. Assessment rigor: 1 Origin: SCF Created BCD-19_A02 the organization utilizes an isolated, non-production environment to perform recovery operations through offline, cloud or off-site capabilities. Assessment rigor: 1 Origin: SCF Created
BCD-20 Reserve Hardware – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: BCD-20_A01 systems and system components that are or may be hard to replace in a supply chain disruption are identified. Assessment rigor: 1 Origin: SCF Created BCD-20_A02 resources are allocated to obtain identified hard-to-replace systems and system components that support critical business functions. Assessment rigor: 1 Origin: SCF Created BCD-20_A03 a pool of identified hard-to-replace systems and system components that support critical business functions is maintained. Assessment rigor: 1 Origin: SCF Created
BCD-21 Redundant Secondary System – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: BCD-21_A01 system backup is conducted by maintaining a redundant secondary system that can be activated without loss of information or disruption to operations. Assessment rigor: 1 Origin: 53A_R5_CP-09(06)[02] BCD-21_A02 system backup is conducted by maintaining a redundant secondary system that is not collocated with the primary system. Assessment rigor: 3 Origin: 53A_R5_CP-09(06)[01]
BCD-22 Failover Capability – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: BCD-22_A01 system components for which Mean Time to Failure (MTTF) should be determined are defined. Assessment rigor: 1 Origin: 53A_R5_SI-13_ODP[01] BCD-22_A02 Mean Time to Failure (MTTF) is determined for system components in specific environments of operation. Assessment rigor: 1 Origin: 53A_R5_SI-13a. BCD-22_A03 Mean Time to Failure (MTTF) substitution criteria to be used as a means to exchange active and standby components are defined. Assessment rigor: 3 Origin: 53A_R5_SI-13_ODP[02] BCD-22_A04 substitute system components and a means to exchange active and standby components are provided in accordance with Mean Time to Failure (MTTF) substitution criteria. Assessment rigor: 3 Origin: 53A_R5_SI-13b.
BCD-23 Resilient Data Backup Architecture – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: BCD-23_A01 a backup architecture is documented that identifies backup storage locations, data flows and the mechanisms used to protect backup copies. Assessment rigor: 1 Origin: SCF Created BCD-23_A02 backup copies are stored in an immutable form (e.g., Write Once Read Many (WORM) storage, object lock or retention lock) that prevents modification or deletion for the defined immutability period. Assessment rigor: 1 Origin: SCF Created BCD-23_A03 the period for which backup copies remain immutable is defined. Assessment rigor: 3 Origin: SCF Created BCD-23_A04 backup copies and backup infrastructure are protected from unauthorized access, including through encryption of backup data and access restrictions on backup repositories. Assessment rigor: 1 Origin: SCF Created BCD-23_A05 privileged actions on the backup infrastructure (e.g., deleting backups or changing retention or immutability settings) are restricted to authorized personnel, require multi-factor authentication and are logged. Assessment rigor: 1 Origin: SCF Created BCD-23_A06 the immutability of backup copies is tested at a defined frequency and the results are documented. Defined parameters: at least quarterly Assessment rigor: 2 Origin: SCF Created
BCD-24 Data Backups – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: BCD-24_A01 the confidentiality of backup sensitive / regulated data is protected at storage locations. Assessment rigor: 1 Origin: 171A_3.8.9 BCD-24_A02 system components for which to conduct backups of user-level information are defined. Assessment rigor: 3 Origin: 53A_R5_CP-09_ODP[01] BCD-24_A03 the frequency at which to conduct backups of user-level information consistent with recovery time and recovery point objectives is defined. Defined parameters: daily incremental; weekly full Assessment rigor: 3 Origin: 53A_R5_CP-09_ODP[02] BCD-24_A04 the frequency at which to conduct backups of system-level information consistent with recovery time and recovery point objectives is defined. Defined parameters: daily incremental; weekly full Assessment rigor: 3 Origin: 53A_R5_CP-09_ODP[03] BCD-24_A05 the frequency at which to conduct backups of system documentation consistent with recovery time and recovery point objectives is defined. Defined parameters: daily incremental; weekly full Assessment rigor: 3 Origin: 53A_R5_CP-09_ODP[04] BCD-24_A06 backups of user-level information contained in system components are conducted frequently. Defined parameters: daily incremental; weekly full Assessment rigor: 3 Origin: 53A_R5_CP-09a. BCD-24_A07 backups of system-level information contained in the system are conducted frequently. Defined parameters: daily incremental; weekly full Assessment rigor: 3 Origin: 53A_R5_CP-09b. BCD-24_A08 backups of system documentation, including security- and privacy-related documentation are conducted frequently. Defined parameters: daily incremental; weekly full Assessment rigor: 3 Origin: 53A_R5_CP-09c. BCD-24_A09 the confidentiality of backup information is protected. Assessment rigor: 3 Origin: 53A_R5_CP-09d.[01] BCD-24_A10 the integrity of backup information is protected. Assessment rigor: 3 Origin: 53A_R5_CP-09d.[02] BCD-24_A11 the availability of backup information is protected. Assessment rigor: 3 Origin: 53A_R5_CP-09d.[03]
BCD-24.1 Transfer to Alternate Storage Site – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: BCD-24.1_A01 system backup information is transferred to the alternate storage site for an organization-defined time period. Assessment rigor: 1 Origin: 53A_R5_CP-09(05)[01] BCD-24.1_A02 time period consistent with recovery time and recovery point objectives is defined. Defined parameters: a time period consistent with the recovery time and recovery point objectives defined in the service provider and organization Service Level Agreement (SLA) Assessment rigor: 3 Origin: 53A_R5_CP-09(05)_ODP[01] BCD-24.1_A03 transfer rate consistent with recovery time and recovery point objectives is defined. Defined parameters: a transfer rate consistent with the recovery time and recovery point objectives defined in the service provider and organization Service Level Agreement (SLA) Assessment rigor: 3 Origin: 53A_R5_CP-09(05)_ODP[02] BCD-24.1_A04 system backup information is transferred to the alternate storage site transfer rate. Assessment rigor: 3 Origin: 53A_R5_CP-09(05)[02]
BCD-24.2 Separate Storage for Critical Information – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: BCD-24.2_A01 critical system software and other security-related information backups to be stored in a separate facility are defined. Assessment rigor: 1 Origin: 53A_R5_CP-09(03)_ODP BCD-24.2_A02 backup copies of critical system software and other security-related information are stored in a separate facility or in a fire rated container that is not collocated with the operational system. Assessment rigor: 3 Origin: 53A_R5_CP-09(03)
BCD-24.3 Cryptographic Protection – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: BCD-24.3_A01 the confidentiality of backup information is protected. Assessment rigor: 1 Origin: 171A_3.8.9 171A_R3_A.03.08.09.a BCD-24.3_A02 backup information to protect against unauthorized disclosure and modification is defined. Defined parameters: all backup files Assessment rigor: 1 Origin: 53A_R5_CP-09(08)_ODP BCD-24.3_A03 cryptographic mechanisms are implemented to prevent the unauthorized disclosure of sensitive / regulated data at backup storage locations. Defined parameters: all backup files Assessment rigor: 3 Origin: 53A_R5_CP-09(08) BCD-24.3_A04 cryptographic mechanisms are implemented to prevent the unauthorized disclosure of CUI at backup storage locations. Assessment rigor: NIST 800-171 Origin: 171A_R3_A.03.08.09.b
BCD-25 Redundant Copies of Business-Critical Data – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: BCD-25_A01 business-critical data requiring redundant copies is identified and documented. Assessment rigor: 1 Origin: SCF Created BCD-25_A02 redundant copies of all business-critical data are maintained within one (1) or more logically vaulted or offline environments. Assessment rigor: 1 Origin: SCF Created BCD-25_A03 logically vaulted or offline environments are isolated from the primary processing environment such that a compromise of production credentials or systems cannot modify or delete the redundant copies. Assessment rigor: 2 Origin: SCF Created BCD-25_A04 the frequency at which redundant copies of business-critical data are updated is defined. Defined parameters: at least weekly, or more frequently as required to meet Recovery Point Objectives (RPOs) Assessment rigor: 3 Origin: SCF Created BCD-25_A05 redundant copies of business-critical data are verified for completeness and recoverability at a defined frequency and the results are documented. Defined parameters: at least quarterly Assessment rigor: 2 Origin: SCF Created
BCD-26 Transaction Recovery – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: BCD-26_A01 transaction recovery is implemented for systems that are transaction-based. Assessment rigor: 1 Origin: 53A_R5_CP-10(02)
BCD-27 Data Replication – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: BCD-27_A01 Recovery Point Objectives (RPOs) are defined for data that requires replication. Assessment rigor: 1 Origin: SCF Created BCD-27_A02 data is replicated to alternate storage or processing locations. Assessment rigor: 1 Origin: SCF Created BCD-27_A03 the replication frequency or replication lag for each replicated data set is configured so that it does not exceed the Recovery Point Objective (RPO) of that data. Assessment rigor: 3 Origin: SCF Created BCD-27_A04 replication status is monitored and replication failures or lag exceeding the Recovery Point Objective (RPO) generate alerts that are investigated and resolved. Assessment rigor: 2 Origin: SCF Created BCD-27_A05 the ability of replicated data to satisfy Recovery Point Objectives (RPOs) is validated at a defined frequency and the results are documented. Defined parameters: at least annually Assessment rigor: 2 Origin: SCF Created
BCD-28 Data Archiving – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: BCD-28_A01 the criteria used to determine when data is no longer in active use and is eligible for archiving are defined. Assessment rigor: 3 Origin: SCF Created BCD-28_A02 applicable statutory, regulatory and contractual retention obligations are identified and documented for each type of archived data. Assessment rigor: 1 Origin: SCF Created BCD-28_A03 data that is no longer in active use is archived to secure storage and retained for the period required by the identified retention obligations. Assessment rigor: 1 Origin: SCF Created BCD-28_A04 archived data is protected from unauthorized access, modification and deletion for the duration of its retention period. Assessment rigor: 1 Origin: SCF Created BCD-28_A05 the retrievability of archived data is tested at a defined frequency and the results are documented. Defined parameters: at least annually Assessment rigor: 2 Origin: SCF Created
BCD-29 Continuous Data Protection (CDP) – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: BCD-29_A01 data requiring Continuous Data Protection (CDP) is identified and documented. Assessment rigor: 1 Origin: SCF Created BCD-29_A02 automated Continuous Data Protection (CDP) mechanisms capture data changes as they occur for the identified data. Assessment rigor: 1 Origin: SCF Created BCD-29_A03 the recovery window for which Continuous Data Protection (CDP) change history is retained is defined. Assessment rigor: 3 Origin: SCF Created BCD-29_A04 Continuous Data Protection (CDP) mechanisms enable recovery of the identified data to a specific point in time within the defined recovery window. Assessment rigor: 2 Origin: SCF Created BCD-29_A05 point-in-time recovery from Continuous Data Protection (CDP) is tested at a defined frequency and the results are documented. Defined parameters: at least annually Assessment rigor: 2 Origin: SCF Created BCD-29_A06 Continuous Data Protection (CDP) operation is monitored and capture failures or gaps generate alerts that are investigated and resolved. Assessment rigor: 2 Origin: SCF Created
BCD-30 Data Backup Access – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: BCD-30_A01 Role Based Access Controls (RBAC) are utilized to logically restrict access to data backups to those privileged users with assigned roles for data backup and recovery operations. Assessment rigor: 1 Origin: SCF Created BCD-30_A02 Physical Access Controls (PAC) are utilized to physically restrict access to data backups to those privileged users with assigned roles for data backup and recovery operations. Assessment rigor: 1 Origin: SCF Created
BCD-31 Data Backup & Restoration Hardware Protection – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: BCD-31_A01 data backup and restoration hardware and software used for recovery and reconstitution are protected. Assessment rigor: 1 Origin: 53A_R5_CP-10(06)
BCD-31.1 Restoration Integrity Verification – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: BCD-31.1_A01 methods to verify the integrity of data backups and other restoration assets are defined. Assessment rigor: 1 Origin: SCF Created BCD-31.1_A02 the integrity of data backups and other restoration assets is verified prior to using them for restoration. Assessment rigor: 2 Origin: SCF Created
BCD-32 Testing for Reliability & Integrity – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: BCD-32_A01 the frequency at which to test data backups for media reliability is defined. Defined parameters: at least annually Assessment rigor: 1 Origin: 53A_R5_CP-09(01)_ODP[01] BCD-32_A02 the frequency at which to test data backups for information integrity is defined. Defined parameters: at least annually Assessment rigor: 1 Origin: 53A_R5_CP-09(01)_ODP[02] BCD-32_A03 data backups are tested at the organization-defined frequency to verify media reliability. Defined parameters: at least annually Assessment rigor: 2 Origin: 53A_R5_CP-09(01)[01] BCD-32_A04 data backups are tested at the organization-defined frequency to verify information integrity. Defined parameters: at least annually Assessment rigor: 2 Origin: 53A_R5_CP-09(01)[02] BCD-32_A05 data backups are tested at the organization-defined frequency to verify the availability of the data. Defined parameters: at least annually Assessment rigor: 2 Origin: SCF Created
BCD-32.1 Test Restoration Using Sampling – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: BCD-32.1_A01 a sample of available data backups is used to test the restoration of selected functions as part of business continuity plan testing. Assessment rigor: 2 Origin: 53A_R5_CP-09(02)
BCD-33 Data Backup Modification and/or Destruction – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: BCD-33_A01 Role Based Access Controls (RBAC) are utilized to logically restrict access to modify and/or delete data backups to only those privileged users with assigned data backup and recovery operations roles. Assessment rigor: 1 Origin: SCF Created
BCD-33.1 Dual Authorization For Sensitive / Regulated Backup Media Destruction – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: BCD-33.1_A01 critical or sensitive system and organizational operations for which dual authorization is to be enforced are identified. Assessment rigor: 1 Origin: 172A_3.1.1e[a] BCD-33.1_A02 dual authorization is employed to execute critical or sensitive system and organizational operations. Assessment rigor: 1 Origin: 172A_3.1.1e[b] BCD-33.1_A03 sensitive and/or regulated backup media and data for which to enforce dual authorization in order to delete or destroy are defined. Assessment rigor: 1 Origin: 53A_R5_CP-09(07)_ODP BCD-33.1_A04 dual authorization for the deletion or destruction of sensitive and/or regulated backup media and data is enforced. Assessment rigor: 2 Origin: 53A_R5_CP-09(07)
CAP-01 Capacity & Performance Planning Policy – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CAP-01_A01 a formal, documented capacity and performance planning policy is approved by executive management, or a formally delegated authority, and conveys executive management's intent for capacity and performance planning. Assessment rigor: 1 Origin: SCF Created CAP-01_A02 the capacity and performance planning policy provides organizational direction and states the behaviors expected of personnel and other applicable parties with respect to capacity and performance planning. Assessment rigor: 1 Origin: SCF Created CAP-01_A03 the current version of the capacity and performance planning policy is communicated to, and accessible by, the personnel and other applicable parties who are expected to comply with it. Assessment rigor: 1 Origin: SCF Created CAP-01_A04 the capacity and performance planning policy is reviewed at least annually. Defined parameters: at least annually Assessment rigor: 1 Origin: SCF Created CAP-01_A05 the capacity and performance planning policy is updated, as necessary, in response to changes in risks, threats, business practices and/or statutory, regulatory and contractual obligations that affect the organization. Assessment rigor: 1 Origin: SCF Created
CAP-02 Capacity & Performance Management – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CAP-02_A01 resources to be allocated to protect the availability of resources are defined. Assessment rigor: 1 Origin: 53A_R5_SC-06_ODP[01] CAP-02_A02 controls to protect the availability of resources are defined. Assessment rigor: 3 Origin: 53A_R5_SC-06_ODP[02] 53A_R5_SC-06_ODP[03] CAP-02_A03 the availability of resources is protected by allocating resources per organization-defined criteria. Assessment rigor: 3 Origin: 53A_R5_SC-06 CAP-02_A04 capacity & performance planning operations are conducted according to documented policies, standards, procedures and/or other organizational directives. Assessment rigor: 1 Origin: SCF Created CAP-02_A05 resources are provided to support capacity & performance planning operations, including at a minimum: people, processes, technologies, data and facilities. Assessment rigor: 1 Origin: SCF Created CAP-02_A06 responsibility and authority for the performance of capacity & performance planning-related activities are assigned to designated personnel. Assessment rigor: 1 Origin: SCF Created CAP-02_A07 personnel performing capacity & performance planning-related activities have the skills and knowledge needed to perform their assigned duties. Assessment rigor: 2 Origin: SCF Created
CAP-03 Capacity Planning – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CAP-03_A01 capacity planning is conducted so that the necessary capacity exists during contingency operations for information processing. Assessment rigor: 1 Origin: 53A_R5_CP-02(02)[01] CAP-03_A02 capacity planning is conducted so that the necessary capacity exists during contingency operations for telecommunications. Assessment rigor: 3 Origin: 53A_R5_CP-02(02)[02] CAP-03_A03 capacity planning is conducted so that the necessary capacity exists during contingency operations for environmental support. Assessment rigor: 3 Origin: 53A_R5_CP-02(02)[03]
CAP-04 Resource Priority – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CAP-04_A01 types of denial-of-service events to be protected against or limited are defined. Defined parameters: at a minimum: ICMP (ping) flood, SYN flood, slowloris, buffer overflow attack, and volume attack Assessment rigor: 1 Origin: 53A_R5_SC-05_ODP[01] CAP-04_A02 controls by type of denial-of-service event are employed to achieve the denial-of-service protection objective. Assessment rigor: 1 Origin: 53A_R5_SC-05b. CAP-04_A03 resource prioritization is designed to limit negative effects of denial-of-service events. Assessment rigor: 3 Origin: 53A_R5_SC-05_ODP[02] CAP-04_A04 controls to achieve the denial-of-service objective by type of denial-of-service event are defined. Assessment rigor: 3 Origin: 53A_R5_SC-05_ODP[03] CAP-04_A05 the effects of types of denial-of-service events are organizationally-defined. Assessment rigor: 3 Origin: 53A_R5_SC-05a.
CAP-05 Performance Monitoring – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CAP-05_A01 the operating state and health status of critical Technology Assets, Applications and/or Services (TAAS) is centrally-monitored. Defined parameters: continuously Assessment rigor: 1 Origin: SCF Created
CAP-06 Elastic Expansion – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CAP-06_A01 resources requiring dynamic expansion (elasticity) are defined. Assessment rigor: 1 Origin: SCF Created CAP-06_A02 Technology Assets, Applications and/or Services (TAAS) identified as requiring dynamic expansion are configured to automatically scale the resources available to them as demand conditions change. Assessment rigor: 1 Origin: SCF Created
CAP-07 Regional Delivery – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CAP-07_A01 business processes requiring regional delivery of technological services are identified. Assessment rigor: 1 Origin: SCF Created CAP-07_A02 Technology Assets, Applications and/or Services (TAAS) are configured to support the geographically dispersed business processes identified as requiring regional delivery. Assessment rigor: 1 Origin: SCF Created
CAP-08 Resiliency Planning For Alternate Sites – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CAP-08_A01 performance and capacity planning includes resiliency planning for alternate storage and/or processing sites. Assessment rigor: 1 Origin: SCF Created CAP-08_A02 the capacity required for alternate storage and/or processing sites to run production operations throughout the duration of Business Continuity & Disaster Recovery (BC/DR) operations is determined and documented. Assessment rigor: 1 Origin: SCF Created CAP-08_A03 alternate storage and/or processing sites are provisioned with, or contractually guaranteed, capacity that meets the documented requirements. Assessment rigor: 2 Origin: SCF Created CAP-08_A04 the frequency at which to review alternate site capacity requirements is defined. Defined parameters: at least annually, and upon significant change Assessment rigor: 1 Origin: SCF Created CAP-08_A05 alternate site capacity requirements are reviewed and updated at the defined frequency and when production workloads change significantly. Assessment rigor: 1 Origin: SCF Created
CHG-01 Change Management Policy – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CHG-01_A01 a formal, documented change management policy is approved by executive management, or a formally delegated authority, and conveys executive management's intent for change management. Assessment rigor: 1 Origin: SCF Created CHG-01_A02 the change management policy provides organizational direction and states the behaviors expected of personnel and other applicable parties with respect to change management. Assessment rigor: 1 Origin: SCF Created CHG-01_A03 the current version of the change management policy is communicated to, and accessible by, the personnel and other applicable parties who are expected to comply with it. Assessment rigor: 1 Origin: SCF Created CHG-01_A04 the change management policy is reviewed at least annually. Defined parameters: at least annually Assessment rigor: 1 Origin: SCF Created CHG-01_A05 the change management policy is updated, as necessary, in response to changes in risks, threats, business practices and/or statutory, regulatory and contractual obligations that affect the organization. Assessment rigor: 1 Origin: SCF Created
CHG-02 Change Management Program – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CHG-02_A01 configuration change control activities are coordinated and overseen by organization-defined configuration change control element. Assessment rigor: 1 Origin: 53A_R5_CM-03g.[01] CHG-02_A02 configuration change decisions associated with the system are documented. Assessment rigor: 1 Origin: 53A_R5_CM-03c. CHG-02_A03 approved configuration-controlled changes to the system are implemented. Assessment rigor: 1 Origin: 53A_R5_CM-03d. CHG-02_A04 the time period to retain records of configuration-controlled changes is defined. Defined parameters: at least 1 year Assessment rigor: 3 Origin: 53A_R5_CM-03_ODP[01] CHG-02_A05 proposed configuration-controlled changes to the system are reviewed. Assessment rigor: 3 Origin: 53A_R5_CM-03b.[01] CHG-02_A06 the configuration change control element responsible for coordinating and overseeing change control activities is defined. Assessment rigor: 3 Origin: 53A_R5_CM-03_ODP[02] CHG-02_A07 the frequency at which the configuration control element convenes is defined. Defined parameters: at least monthly, and when changes requiring review are proposed Assessment rigor: 3 Origin: 53A_R5_CM-03_ODP[03] 53A_R5_CM-03_ODP[04] CHG-02_A08 configuration change conditions that prompt the configuration control element to convene are defined. Assessment rigor: 3 Origin: 53A_R5_CM-03_ODP[05] CHG-02_A09 the types of changes to the system that are configuration-controlled are determined and documented. Assessment rigor: 3 Origin: 53A_R5_CM-03a. CHG-02_A10 proposed configuration-controlled changes to the system are approved or disapproved with explicit consideration for cybersecurity / data privacy impact analyses. Assessment rigor: 3 Origin: 53A_R5_CM-03b.[02] CHG-02_A11 records of configuration-controlled changes to the system are retained for an organization-defined time period. Defined parameters: at least 1 year Assessment rigor: 3 Origin: 53A_R5_CM-03e. CHG-02_A12 activities associated with configuration-controlled changes to the system are monitored. Assessment rigor: 2 Origin: 53A_R5_CM-03f.[01] 171A_R3_A.03.04.03.d[01] CHG-02_A13 activities associated with configuration-controlled changes to the system are reviewed. Assessment rigor: 2 Origin: 53A_R5_CM-03f.[02] 171A_R3_A.03.04.03.d[02] CHG-02_A14 the configuration control element convenes organization-defined criteria. Assessment rigor: 3 Origin: 53A_R5_CM-03g.[02] CHG-02_A15 change management operations are conducted according to documented policies, standards, procedures and/or other organizational directives. Assessment rigor: 1 Origin: SCF Created CHG-02_A16 resources are assigned to support change management operations, including at a minimum: people, processes, technologies, data and facilities. Assessment rigor: 1 Origin: SCF Created CHG-02_A17 responsibility and authority for the performance of change management-related activities are assigned to designated personnel. Assessment rigor: 1 Origin: SCF Created CHG-02_A18 personnel performing change management-related activities have the skills and knowledge needed to perform their assigned duties. Assessment rigor: 2 Origin: SCF Created
CHG-03 Configuration Change Control – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CHG-03_A01 changes to the system are reviewed. Assessment rigor: 1 Origin: 171A_3.4.3[b] CHG-03_A02 changes to the system are approved or disapproved. Assessment rigor: 1 Origin: 171A_3.4.3[c] CHG-03_A03 approved configuration-controlled changes to the system are implemented. Assessment rigor: 1 Origin: 171A_R3_A.03.04.03.c[01] CHG-03_A04 changes to the system are logged. Assessment rigor: 2 Origin: 171A_3.4.3[d] CHG-03_A05 changes to the system are tracked. Assessment rigor: 2 Origin: 171A_3.4.3[a] CHG-03_A06 the types of changes to the system that are configuration-controlled are defined. Assessment rigor: 2 Origin: 171A_R3_A.03.04.03.a
CHG-04 Prohibition Of Changes – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CHG-04_A01 mechanisms used to automate configuration change control are defined. Assessment rigor: 1 Origin: 53A_R5_CM-03(01)_ODP[01] CHG-04_A02 organization-defined automated mechanisms are used to prohibit unauthorized changes unless the change is approved through the organization's defined change management processes. Assessment rigor: 1 Origin: 53A_R5_CM-03(01)(d) CHG-04_A03 approval authorities to be notified of and request approval for proposed changes to the system are defined. Assessment rigor: 3 Origin: 53A_R5_CM-03(01)_ODP[02] CHG-04_A04 the time period after which to highlight changes that have not been approved or disapproved is defined. Assessment rigor: 3 Origin: 53A_R5_CM-03(01)_ODP[03] CHG-04_A05 personnel to be notified when approved changes are complete is/are defined. Assessment rigor: 3 Origin: 53A_R5_CM-03(01)_ODP[04] CHG-04_A06 organization-defined automated mechanisms are used to document proposed changes to the system. Assessment rigor: 3 Origin: 53A_R5_CM-03(01)(a) CHG-04_A07 organization-defined automated mechanisms are used to notify organization-defined approval authorities of proposed changes to the system and request change approval. Assessment rigor: 3 Origin: 53A_R5_CM-03(01)(b) CHG-04_A08 organization-defined automated mechanisms are used to highlight proposed changes to the system that have not been approved or disapproved within an organization-defined time period. Assessment rigor: 3 Origin: 53A_R5_CM-03(01)(c) CHG-04_A09 organization-defined automated mechanisms are used to document all changes to the system. Assessment rigor: 3 Origin: 53A_R5_CM-03(01)(e) CHG-04_A10 organization-defined automated mechanisms are used to notify organization-defined personnel when approved changes to the system are completed. Assessment rigor: 3 Origin: 53A_R5_CM-03(01)(f) CHG-04_A11 proposed configuration-controlled changes to the system are approved or disapproved with explicit consideration for security impacts. Assessment rigor: 2 Origin: 171A_R3_A.03.04.03.b[02] CHG-04_A12 logical access restrictions associated with changes to the system are approved. Assessment rigor: 2 Origin: 171A_R3_A.03.04.05[05]
CHG-04.1 Access Restriction For Change – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CHG-04.1_A01 logical access restrictions associated with changes to the system are defined and documented. Assessment rigor: 1 Origin: 171A_3.4.5[e] 171A_3.4.5[f] 53A_R5_CM-05[04] CHG-04.1_A02 logical access restrictions associated with changes to the system are enforced. Assessment rigor: 1 Origin: 171A_3.4.5[h] 53A_R5_CM-05[06] CHG-04.1_A03 logical access restrictions associated with changes to the system are approved. Assessment rigor: 2 Origin: 171A_3.4.5[g] 53A_R5_CM-05[05] CHG-04.1_A04 physical access restrictions associated with changes to the system are defined and documented. Assessment rigor: 2 Origin: 171A_3.4.5[a] 171A_3.4.5[b] 53A_R5_CM-05[01] CHG-04.1_A05 physical access restrictions associated with changes to the system are approved. Assessment rigor: 2 Origin: 171A_3.4.5[c] 53A_R5_CM-05[02] CHG-04.1_A06 physical access restrictions associated with changes to the system are enforced. Assessment rigor: 2 Origin: 171A_3.4.5[d] 53A_R5_CM-05[03] CHG-04.1_A07 physical access restrictions associated with changes to the system are defined and documented. Assessment rigor: 1 Origin: 171A_3.4.5[a] 171A_3.4.5[b] 53A_R5_CM-05[01] CHG-04.1_A08 physical access restrictions associated with changes to the system are approved. Assessment rigor: 1 Origin: 171A_3.4.5[c] 53A_R5_CM-05[02] CHG-04.1_A09 physical access restrictions associated with changes to the system are enforced. Assessment rigor: 1 Origin: 171A_3.4.5[d] 53A_R5_CM-05[03] CHG-04.1_A10 logical access restrictions associated with changes to the system are defined and documented. Assessment rigor: 1 Origin: 171A_3.4.5[e] 171A_3.4.5[f] 53A_R5_CM-05[04] CHG-04.1_A11 logical access restrictions associated with changes to the system are approved. Assessment rigor: 1 Origin: 171A_3.4.5[g] 53A_R5_CM-05[05] CHG-04.1_A12 logical access restrictions associated with changes to the system are enforced. Assessment rigor: 1 Origin: 171A_3.4.5[h] 53A_R5_CM-05[06]
CHG-04.2 Role-Based Permissions To Implement Changes – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CHG-04.2_A01 policies governing the installation of software by users are established. Assessment rigor: 2 Origin: 53A_R5_CM-11_ODP[01] 53A_R5_CM-11a. CHG-04.2_A02 the frequency with which to monitor compliance is defined. Defined parameters: continuously Assessment rigor: 3 Origin: 53A_R5_CM-11_ODP[03] CHG-04.2_A03 privileges to implement changes to Technology Assets, Applications and/or Services (TAAS) within a production or operational environment are limited to designated privileged roles. Assessment rigor: 1 Origin: 53A_R5_CM-05(05)(a)[01] CHG-04.2_A04 logical access restrictions associated with changes to the system are enforced. Assessment rigor: 1 Origin: 171A_R3_A.03.04.05[06] CHG-04.2_A05 the frequency at which to review privileges is defined. Defined parameters: at least quarterly Assessment rigor: 3 Origin: 53A_R5_CM-05(05)_ODP[01] CHG-04.2_A06 the frequency at which to reevaluate privileges is defined. Defined parameters: at least quarterly Assessment rigor: 3 Origin: 53A_R5_CM-05(05)_ODP[02] CHG-04.2_A07 privileges to change system-related information within a production or operational environment are limited to designated privileged roles. Assessment rigor: 1 Origin: 53A_R5_CM-05(05)(a)[02] CHG-04.2_A08 privileges are reviewed per an organization-defined frequency. Defined parameters: at least quarterly Assessment rigor: 3 Origin: 53A_R5_CM-05(05)(b)[01] CHG-04.2_A09 privileges are reevaluated per an organization-defined frequency. Defined parameters: at least quarterly Assessment rigor: 3 Origin: 53A_R5_CM-05(05)(b)[02] CHG-04.2_A10 users allowed to independently configure wireless networking capabilities are identified. Assessment rigor: 1 Origin: 53A_R5_AC-18(04)[01] CHG-04.2_A11 users allowed to independently configure wireless networking capabilities are explicitly authorized. Assessment rigor: 1 Origin: 53A_R5_AC-18(04)[02] CHG-04.2_A12 radio antennas are selected to reduce the probability that signals from wireless access points can be received outside of organization-controlled boundaries. Assessment rigor: 1 Origin: 53A_R5_AC-18(05)[01] CHG-04.2_A13 the designated privileged roles permitted to implement Technology Assets, Applications and/or Services (TAAS) changes are defined. Assessment rigor: 1 Origin: SCF Created
CHG-04.3 Dual Authorization for Changes To Critical / Sensitive Technology Assets, Applications and/or Services (TAAS) – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CHG-04.3_A01 critical or sensitive system and organizational operations for which dual authorization is to be enforced are identified. Assessment rigor: 1 Origin: 172A_3.1.1e[a] 53A_R5_CM-05(04)_ODP[01] 53A_R5_CM-05(04)_ODP[02] CHG-04.3_A02 dual authorization is employed to execute critical or sensitive system and organizational operations. Assessment rigor: 1 Origin: 172A_3.1.1e[b] 53A_R5_CM-05(04)[01] 53A_R5_CM-05(04)[02] CHG-04.3_A03 privileged commands and/or other actions requiring dual authorization are defined. Assessment rigor: 1 Origin: 53A_R5_AC-03(02)_ODP CHG-04.3_A04 dual authorization is enforced for organization-defined privileged commands and/or other actions. Assessment rigor: 1 Origin: 53A_R5_AC-03(02) CHG-04.3_A05 critical or sensitive system and organizational operations for which dual authorization is to be enforced are identified. Assessment rigor: 1 Origin: 172A_3.1.1e[a] 53A_R5_CM-05(04)_ODP[01] CHG-04.3_A06 dual authorization is employed to execute critical or sensitive system and organizational operations. Assessment rigor: 3 Origin: 172A_3.1.1e[b] 53A_R5_CM-05(04)[01] 53A_R5_CM-05(04)[02] CHG-04.3_A07 changes to critical and/or sensitive Technology Assets, Applications and/or Services (TAAS) are implemented only under a two-person rule. Assessment rigor: 2 Origin: SCF Created
CHG-04.4 Dual Approval For High-Impact Environments – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CHG-04.4_A01 business processes where a proposed change might result in a serious incident that could adversely impact operations are identified as requiring dual approval. Assessment rigor: 1 Origin: SCF Created CHG-04.4_A02 Technology Assets, Applications, Services and/or Data (TAASD) where a proposed change might result in a serious incident that could adversely impact operations are identified as requiring dual approval. Assessment rigor: 1 Origin: SCF Created CHG-04.4_A03 processes and/or technologies are implemented to require dual approval for changes that might result in a serious incident that could adversely impact operations. Assessment rigor: 1 Origin: SCF Created
CHG-05 Security, Compliance & Resilience Representative for Asset Lifecycle Changes – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CHG-05_A01 the configuration change control element of which the cybersecurity / data privacy representatives are to be members is defined. Defined parameters: Configuration Control Board (CCB) or similar function Assessment rigor: 1 Origin: 53A_R5_CM-03(04)_ODP[03] CHG-05_A02 security representatives required to be members of the change control element are defined. Assessment rigor: 3 Origin: 53A_R5_CM-03(04)_ODP[01] CHG-05_A03 privacy representatives required to be members of the change control element are defined. Assessment rigor: 3 Origin: 53A_R5_CM-03(04)_ODP[02] CHG-05_A04 organization-defined security representatives are required to be members of the organization-defined configuration change control element. Assessment rigor: 3 Origin: 53A_R5_CM-03(04)[01] CHG-05_A05 organization-defined privacy representatives are required to be members of the organization-defined configuration change control element. Assessment rigor: 3 Origin: 53A_R5_CM-03(04)[02]
CHG-06 Security Impact Analysis for Changes – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CHG-06_A01 proposed configuration-controlled changes to the system are reviewed with explicit consideration for security impacts. Assessment rigor: 1 Origin: 171A_3.4.4 171A_R3_A.03.04.03.b[01] CHG-06_A02 changes to the system are analyzed to determine potential security impacts prior to change implementation. Assessment rigor: 2 Origin: 53A_R5_CM-04[01] 171A_R3_A.03.04.04.a CHG-06_A03 changes to the system are analyzed to determine potential privacy impacts prior to change implementation. Assessment rigor: 3 Origin: 53A_R5_CM-04[02]
CHG-07 Test, Validate & Document Changes – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CHG-07_A01 changes to the system are tested before finalizing the implementation of the changes. Assessment rigor: 1 Origin: 53A_R5_CM-03(02)[01] CHG-07_A02 changes to the system are validated before finalizing the implementation of the changes. Assessment rigor: 1 Origin: 53A_R5_CM-03(02)[02] CHG-07_A03 changes to the system are documented before finalizing the implementation of the changes. Assessment rigor: 1 Origin: 53A_R5_CM-03(02)[03] CHG-07_A04 the frequency at which changes are to be reviewed is defined. Assessment rigor: 3 Origin: 53A_R5_CM-03(07)_ODP[01] CHG-07_A05 the circumstances under which changes are to be reviewed are defined. Assessment rigor: 3 Origin: 53A_R5_CM-03(07)_ODP[02] CHG-07_A06 changes to the system are reviewed organization-defined frequency or when organization-defined circumstances to determine whether unauthorized changes have occurred. Assessment rigor: 3 Origin: 53A_R5_CM-03(07) CHG-07_A07 systems or system components that implement the security design principle of secure system modification are defined. Assessment rigor: 3 Origin: 53A_R5_SA-08(31)_ODP CHG-07_A08 systems or system components implement the security design principle of secure system modification. Assessment rigor: 3 Origin: 53A_R5_SA-08(31) CHG-07_A09 approved configuration-controlled changes to the system are documented. Assessment rigor: 2 Origin: 171A_R3_A.03.04.03.c[02]
CHG-08 Stakeholder Notification of Changes – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CHG-08_A01 as part of change management processes, stakeholders are notified of the potential impact(s) of proposed changes. Defined parameters: prior to implementation of the proposed change Assessment rigor: 1 Origin: SCF Created CHG-08_A02 changes to the system or system component location where sensitive / regulated data is processed are documented. Assessment rigor: 3 Origin: SCF Created CHG-08_A03 changes to the system or system component location where sensitive / regulated data is stored are documented. Assessment rigor: 3 Origin: SCF Created CHG-08_A04 changes to the system or system component location where CUI is processed are documented. Assessment rigor: NIST 800-171 Origin: 171A_R3_A.03.04.11.b[01] CHG-08_A05 changes to the system or system component location where CUI is stored are documented. Assessment rigor: NIST 800-171 Origin: 171A_R3_A.03.04.11.b[02]
CHG-09 Control Functionality Verification – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CHG-09_A01 security functions to be verified for correct operation are defined. Assessment rigor: 1 Origin: 53A_R5_SI-06_ODP[01] CHG-09_A02 organization-defined activities are initiated when anomalies are discovered. Assessment rigor: 1 Origin: 53A_R5_SI-06d. 53A_R5_SI-06_ODP[07] CHG-09_A03 the security requirements for the system continue to be satisfied after the system changes have been implemented. Assessment rigor: 1 Origin: 171A_R3_A.03.04.04.b CHG-09_A04 privacy functions to be verified for correct operation are defined. Assessment rigor: 3 Origin: 53A_R5_SI-06_ODP[02] CHG-09_A05 system transitional states requiring the verification of cybersecurity / data privacy functions are defined. Defined parameters: to include upon system startup and/or restart Assessment rigor: 3 Origin: 53A_R5_SI-06_ODP[04] CHG-09_A06 the frequency at which to verify the correct operation of cybersecurity / data privacy functions is defined. Defined parameters: at least monthly, and upon system startup or restart Assessment rigor: 3 Origin: 53A_R5_SI-06_ODP[05] CHG-09_A07 alternative action(s) to be performed when anomalies are discovered are defined. Assessment rigor: 3 Origin: 53A_R5_SI-06_ODP[08] CHG-09_A08 cybersecurity / data privacy functions are verified to be operating correctly. Defined parameters: to include upon system startup and/or restart Assessment rigor: 3 Origin: 53A_R5_SI-06a.[01] 53A_R5_SI-06b.[01] 53A_R5_CM-03(02)[01] 53A_R5_CM-03(02)[02] CHG-09_A09 personnel or roles to be alerted of failed cybersecurity / data privacy verification tests is/are defined. Defined parameters: to include system administrators and security personnel Assessment rigor: 3 Origin: 53A_R5_SI-06_ODP[06] CHG-09_A10 pertinent personnel or roles is/are alerted to failed cybersecurity / data privacy verification tests. Defined parameters: to include system administrators and security personnel Assessment rigor: 3 Origin: 53A_R5_SI-06c.[01] 53A_R5_SI-06c.[02]
CHG-09.1 Report Verification Results – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CHG-09.1_A01 personnel or roles designated to receive the results of cybersecurity / data privacy function verification is/are defined. Assessment rigor: 1 Origin: 53A_R5_SI-06(03)_ODP CHG-09.1_A02 the results of security and/or function verification are reported to pertinent personnel or roles. Assessment rigor: 1 Origin: 53A_R5_SI-06(03)[01] 53A_R5_SI-06(03)[02]
CHG-10 Emergency Changes – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CHG-10_A01 criteria for "emergency" changes are defined. Assessment rigor: 1 Origin: SCF Created CHG-10_A02 change management procedures govern "emergency" changes. Assessment rigor: 1 Origin: SCF Created
CHG-10.1 Documenting Emergency Changes – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CHG-10.1_A01 the documented results of "emergency" changes include an explanation for why standard change management procedures could not be followed. Assessment rigor: 1 Origin: SCF Created
CHG-11 Post Configuration Change Reviews – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CHG-11_A01 mechanisms used to automate the enforcement of access restrictions are defined. Assessment rigor: 1 Origin: 53A_R5_CM-05(01)_ODP CHG-11_A02 access restrictions for change are enforced using organization-defined automated mechanisms. Assessment rigor: 1 Origin: 53A_R5_CM-05(01)(a) CHG-11_A03 audit records of enforcement actions are automatically generated. Assessment rigor: 3 Origin: 53A_R5_CM-05(01)(b)
CHG-11.1 Automated Security Response – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CHG-11.1_A01 the organization-approved configuration settings to be automatically restored upon detection of unauthorized configuration change(s) are defined. Assessment rigor: 1 Origin: 53A_R5_CM-03(05)_ODP CHG-11.1_A02 organization-approved configuration settings are automatically restored upon detection of unauthorized configuration change(s). Assessment rigor: 2 Origin: 53A_R5_CM-03(05) CHG-11.1_A03 automated mechanisms place misconfigured or unauthorized system components in a quarantine or remediation network. Assessment rigor: 3 Origin: 172A_3.4.2e_ODP[1] CHG-11.1_A04 automated mechanisms to detect misconfigured or unauthorized system components are identified. Assessment rigor: 3 Origin: 172A_3.4.2e[a] CHG-11.1_A05 automated mechanisms are employed to detect misconfigured or unauthorized system components. Assessment rigor: 3 Origin: 172A_3.4.2e[b] CHG-11.1_A06 misconfigured or unauthorized system components are detected. Assessment rigor: 3 Origin: 172A_3.4.2e[c] CHG-11.1_A07 after detection, system components are removed and/or placed in a quarantine or remediation network to facilitate patching, re-configuration or other mitigations. Assessment rigor: 3 Origin: 172A_3.4.2e[d]
CHG-12 Unauthorized Software Installation Alerts – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CHG-12_A01 compliance with software installation policies is enforced using organization-defined automated mechanisms. Assessment rigor: 1 Origin: 53A_R5_CM-11(03)[01] CHG-12_A02 automated mechanisms used to monitor compliance are defined. Assessment rigor: 3 Origin: 53A_R5_CM-11(03)_ODP[02] CHG-12_A03 the installation of software is monitored using organization-defined automated mechanisms to detect unauthorized software installations. Assessment rigor: 1 Origin: 53A_R5_CM-11(03)[02] CHG-12_A04 automated mechanisms used to detect the presence of unauthorized hardware, software and/or firmware within the system are defined. Defined parameters: automated mechanisms with a maximum five-minute delay in detection Assessment rigor: 1 Origin: 53A_R5_CM-08(03)_ODP[01] 53A_R5_CM-08(03)_ODP[02] 53A_R5_CM-08(03)_ODP[03] CHG-12_A05 unauthorized software installations are detected using automated mechanisms at the organization-defined frequency. Defined parameters: continuously Assessment rigor: 2 Origin: 53A_R5_CM-08(03)(a)[01] 53A_R5_CM-08(03)(a)[02] 53A_R5_CM-08(03)(a)[03] CHG-12_A06 the frequency at which automated mechanisms are used to detect the presence of unauthorized hardware, software and/or firmware within the system is defined. Defined parameters: automated mechanisms with a maximum five-minute delay in detection Assessment rigor: 3 Origin: 53A_R5_CM-08(03)_ODP[04] CHG-12_A07 automated mechanisms generate an alert to organization-defined personnel or roles upon the detection of an unauthorized software installation. Assessment rigor: 2 Origin: 53A_R5_CM-08(03)_ODP[05] CHG-12_A08 personnel or roles to be alerted upon the detection of an unauthorized software installation are defined. Assessment rigor: 3 Origin: 53A_R5_CM-08(03)_ODP[06] CHG-12_A09 organization-defined actions are taken when unauthorized hardware, software and/or firmware is detected. Assessment rigor: 3 Origin: 53A_R5_CM-08(03)(b)[01] 53A_R5_CM-08(03)(b)[02] 53A_R5_CM-08(03)(b)[03]
CHG-13 Signed Components – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CHG-13_A01 software or firmware components requiring verification of a digitally signed certificate before installation are defined. Assessment rigor: 1 Origin: 53A_R5_CM-14_ODP[01] 53A_R5_CM-14_ODP[02] CHG-13_A02 the installation of software or firmware components is prevented unless it is verified that the software has been digitally signed using a certificate recognized and approved by the organization. Assessment rigor: 1 Origin: 53A_R5_CM-14[01] 53A_R5_CM-14[02] CHG-13_A03 software or firmware components to be authenticated by cryptographic mechanisms prior to installation are defined. Defined parameters: to include all software and firmware inside the boundary Assessment rigor: 3 Origin: 53A_R5_SI-07(15)_ODP CHG-13_A04 cryptographic mechanisms are implemented to authenticate software or firmware components prior to installation. Assessment rigor: 3 Origin: 53A_R5_SI-07(15)
CLD-01 Cloud Security Policy – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CLD-01_A01 a formal, documented cloud security policy is approved by executive management, or a formally delegated authority, and conveys executive management's intent for cloud security. Assessment rigor: 1 Origin: SCF Created CLD-01_A02 the cloud security policy provides organizational direction and states the behaviors expected of personnel and other applicable parties with respect to cloud security. Assessment rigor: 1 Origin: SCF Created CLD-01_A03 the current version of the cloud security policy is communicated to, and accessible by, the personnel and other applicable parties who are expected to comply with it. Assessment rigor: 1 Origin: SCF Created CLD-01_A04 the cloud security policy is reviewed at least annually. Defined parameters: at least annually Assessment rigor: 1 Origin: SCF Created CLD-01_A05 the cloud security policy is updated, as necessary, in response to changes in risks, threats, business practices and/or statutory, regulatory and contractual obligations that affect the organization. Assessment rigor: 1 Origin: SCF Created
CLD-02 Cloud Services – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CLD-02_A01 cloud management controls are implemented so that cloud instances are securely configured and maintained. Assessment rigor: 1 Origin: SCF Created CLD-02_A02 secure baseline configurations exist for cloud-based systems, applications and services to protect the confidentiality, integrity and availability of data being stored, processed and/or transmitted. Defined parameters: an industry-recognized secure configuration benchmark, or a documented equivalent Assessment rigor: 2 Origin: SCF Created CLD-02_A03 cloud management operations are conducted according to documented policies, standards, procedures and/or other organizational directives. Assessment rigor: 1 Origin: SCF Created CLD-02_A04 resources are assigned to support cloud management operations, including at a minimum: people, processes, technologies, data and facilities. Assessment rigor: 1 Origin: SCF Created CLD-02_A05 responsibility and authority for the performance of cloud management-related activities are assigned to designated personnel. Assessment rigor: 1 Origin: SCF Created CLD-02_A06 personnel performing cloud management-related activities have the skills and knowledge needed to perform their assigned duties. Assessment rigor: 2 Origin: SCF Created
CLD-03 Cloud Infrastructure Onboarding – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CLD-03_A01 the design and configuration process for cloud services is formally governed so Technology Assets, Applications and/or Services (TAAS) are secured in accordance with applicable organizational standards, as well as statutory, regulatory and contractual obligations. Assessment rigor: 1 Origin: SCF Created
CLD-03.1 Customer Responsibility Matrix (CRM) – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CLD-03.1_A01 a documented Customer Responsibility Matrix (CRM) delineates assigned responsibilities for controls between the Cloud Service Provider (CSP) and its customers. Assessment rigor: 1 Origin: SCF Created
CLD-04 Cloud Infrastructure Offboarding – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CLD-04_A01 the decommission process for cloud services is formally governed so that data is securely transitioned to new systems or archived in accordance with applicable organizational standards, as well as statutory, regulatory and contractual obligations. Assessment rigor: 1 Origin: SCF Created
CLD-05 Cloud Security Architecture – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CLD-05_A01 a cloud security architecture is defined to address cloud deployments that support the organization's mission. Assessment rigor: 1 Origin: SCF Created CLD-05_A02 the cloud security architecture supports the organization's technology strategy to securely design, configure and maintain cloud deployments. Assessment rigor: 1 Origin: SCF Created
CLD-06 Cloud Infrastructure Security Subnet – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CLD-06_A01 cloud security management subnets are logically isolated. Assessment rigor: 1 Origin: 53A_R5_SC-07(29)_ODP[01] CLD-06_A02 cloud security management subnet system components and functions to be isolated are defined. Assessment rigor: 3 Origin: 53A_R5_SC-07(29)_ODP[02] CLD-06_A03 organization-defined criteria are used to isolate cloud security management subnets. Assessment rigor: 3 Origin: 53A_R5_SC-07(29)
CLD-07 Multi-Tenant Environments – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CLD-07_A01 multi-tenant owned / managed assets (physical and virtual) are designed and governed such that provider and customer (tenant) user access is segmented from other tenant users. Assessment rigor: 1 Origin: SCF Created
CLD-07.1 Multi-Tenant Event Logging Capabilities – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CLD-07.1_A01 for Multi-Tenant Service Providers (MTSP), security event logging capabilities provided to customers are consistent with the customers' applicable statutory, regulatory and/or contractual obligations. Defined parameters: a log retention period no shorter than the longest applicable statutory, regulatory or contractual requirement Assessment rigor: 1 Origin: SCF Created
CLD-07.2 Multi-Tenant Forensics Capabilities – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CLD-07.2_A01 for Multi-Tenant Service Providers (MTSP), there is a capability to initiate forensic investigations within an organization-defined period following a suspected or confirmed security incident. Defined parameters: no more than 24 hours Assessment rigor: 1 Origin: SCF Created
CLD-07.3 Multi-Tenant Incident Response Capabilities – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CLD-07.3_A01 for Multi-Tenant Service Providers (MTSP), there is a capability to respond to suspected or confirmed security incidents and vulnerabilities within an organization-defined period. Defined parameters: response: no more than 24 hours; customer notification: no later than the shortest applicable statutory, regulatory or contractual deadline Assessment rigor: 1 Origin: SCF Created
CLD-08 Data Handling & Portability – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CLD-08_A01 cloud providers use secure protocols for the import, export and management of data in cloud-based Technology Assets, Applications and/or Services (TAAS). Assessment rigor: 1 Origin: SCF Created
CLD-09 Standardized Virtualization Formats – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CLD-09_A01 cloud providers use industry-recognized formats to support secure interoperability. Assessment rigor: 1 Origin: SCF Created CLD-09_A02 cloud providers provide documentation of custom changes to virtualization formats for review by affected stakeholders. Assessment rigor: 1 Origin: SCF Created
CLD-10 Sensitive Data In Public Cloud Providers – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CLD-10_A01 sensitive / regulated data in public cloud providers is identified and documented. Assessment rigor: 1 Origin: SCF Created CLD-10_A02 the storage of sensitive / regulated data in public cloud providers is limited and managed in accordance with documented organizational restrictions. Assessment rigor: 1 Origin: SCF Created
CLD-11 Cloud Access Security Broker (CASB) – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CLD-11_A01 a Cloud Access Security Broker (CASB), or similar technology, is utilized to provide boundary protection and monitoring functions that both provide access to the cloud and protect the organization from misuse of cloud resources. Assessment rigor: 1 Origin: SCF Created
CLD-12 Hosted Technology Assets, Applications and/or Services (TAAS) – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CLD-12_A01 applicable security, compliance and resilience controls that must be implemented on external Technology Assets, Applications and/or Services (TAAS) are specified, consistent with the contractual obligations established with the External Service Providers (ESP) owning, operating and/or maintaining external TAAS. Assessment rigor: 1 Origin: SCF Created
CLD-12.1 Authorized Individuals For Hosted Technology Assets, Applications and/or Services (TAAS) – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CLD-12.1_A01 specified individuals are authorized to access External Service Providers (ESP) owned, operated and/or maintained external Technology Assets, Applications and/or Services (TAAS). Assessment rigor: 1 Origin: SCF Created
CLD-12.2 Sensitive / Regulated Data On Hosted Technology Assets, Applications and/or Services (TAAS) – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CLD-12.2_A01 formal processes are defined to store, process and/or transmit sensitive / regulated data using External Service Providers (ESP) owned, operated and/or maintained external Technology Assets, Applications and/or Services (TAAS), in accordance with all applicable statutory, regulatory and/or contractual obligations. Assessment rigor: 1 Origin: SCF Created
CLD-13 Prohibition On Unverified Hosted Technology Assets, Applications and/or Services (TAAS) – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CLD-13_A01 access to, or usage of, hosted Technology Assets, Applications and/or Services (TAAS) is prohibited until applicable security, compliance and/or resilience control implementation is verified. Assessment rigor: 1 Origin: SCF Created
CPL-01 Compliance Policy – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CPL-01_A01 a formal, documented compliance policy is approved by executive management, or a formally delegated authority, and conveys executive management's intent for compliance. Assessment rigor: 1 Origin: SCF Created CPL-01_A02 the compliance policy provides organizational direction and states the behaviors expected of personnel and other applicable parties with respect to compliance. Assessment rigor: 1 Origin: SCF Created CPL-01_A03 the current version of the compliance policy is communicated to, and accessible by, the personnel and other applicable parties who are expected to comply with it. Assessment rigor: 1 Origin: SCF Created CPL-01_A04 the compliance policy is reviewed at least annually. Defined parameters: at least annually Assessment rigor: 1 Origin: SCF Created CPL-01_A05 the compliance policy is updated, as necessary, in response to changes in risks, threats, business practices and/or statutory, regulatory and contractual obligations that affect the organization. Assessment rigor: 1 Origin: SCF Created
CPL-02 Statutory, Regulatory & Contractual Compliance – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CPL-02_A01 the organization analyzes its business practices to determine applicable statutory, regulatory and/or contractual obligations. Assessment rigor: 1 Origin: SCF Created CPL-02_A02 compliance management operations are conducted according to documented policies, standards, procedures and/or other organizational directives. Assessment rigor: 1 Origin: SCF Created CPL-02_A03 resources are provided to support compliance management operations, including at a minimum: people, processes, technologies, data and facilities. Assessment rigor: 1 Origin: SCF Created CPL-02_A04 responsibility and authority for the performance of compliance management-related activities are assigned to designated personnel. Assessment rigor: 1 Origin: SCF Created CPL-02_A05 personnel performing compliance management-related activities have the skills and knowledge needed to perform their assigned duties. Assessment rigor: 2 Origin: SCF Created
CPL-03 Compliance Scope – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CPL-03_A01 the organization's applicable cybersecurity / data privacy controls are determined through an analysis of business practices that identifies required statutory, regulatory and/or contractual compliance obligations. Assessment rigor: 1 Origin: SCF Created CPL-03_A02 a process exists to validate the scope of cybersecurity / data privacy controls that are determined to meet statutory, regulatory and/or contractual compliance obligations per an organization-defined frequency. Defined parameters: at least annually Assessment rigor: 1 Origin: SCF Created
CPL-04 Ability To Demonstrate Conformity – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CPL-04_A01 a capability exists to demonstrate conformity with applicable cybersecurity and data protection laws, regulations and/or contractual obligations. Assessment rigor: 3 Origin: SCF Created CPL-04_A02 responsibility for demonstrating conformity with applicable cybersecurity and data protection laws, regulations and/or contractual obligations is assigned to designated personnel or roles. Assessment rigor: 3 Origin: SCF Created
CPL-04.1 Conformity Assessment – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CPL-04.1_A01 assessments are conducted to demonstrate conformity with applicable cybersecurity and data protection laws, regulations and/or contractual obligations. Defined parameters: at least annually Assessment rigor: 1 Origin: SCF Created
CPL-04.2 Designated Certifying Official – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CPL-04.2_A01 an individual is assigned the authority to make statements of conformity on behalf of the organization. Assessment rigor: 1 Origin: SCF Created CPL-04.2_A02 the designated individual is provided formal guidance on the limitations of statements of conformity that can be made on behalf of the organization. Assessment rigor: 1 Origin: SCF Created
CPL-04.3 Conformity Attestations – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CPL-04.3_A01 the process for the certifying official to attest to the accuracy of conformity attestations is defined. Assessment rigor: 1 Origin: SCF Created CPL-04.3_A02 the certifying official attests to the accuracy of conformity attestations, based on applicable laws, regulations and/or contractual criteria. Assessment rigor: 1 Origin: SCF Created
CPL-04.4 Declaration of Conformity – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CPL-04.4_A01 a declaration of conformity is generated for each conformity assessment. Assessment rigor: 1 Origin: SCF Created
CPL-05 Conformity Monitoring – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CPL-05_A01 the frequency at which to assess controls in the system and its environment of operation is defined. Defined parameters: at least annually Assessment rigor: 1 Origin: 53A_R5_CA-02_ODP[01] CPL-05_A02 an appropriate assessor or assessment team is selected for the type of assessment to be conducted. Assessment rigor: 1 Origin: 53A_R5_CA-02a. CPL-05_A03 the security requirements for the system and its environment of operation are assessed per an organization-defined frequency to determine if the requirements have been satisfied. Defined parameters: at least annually Assessment rigor: 1 Origin: SCF Created CPL-05_A04 individuals or roles to whom control assessment results are to be provided are defined. Assessment rigor: 3 Origin: 53A_R5_CA-02_ODP[02] CPL-05_A05 a control assessment plan is developed that describes the scope of the assessment, including controls and control enhancements under assessment. Assessment rigor: 3 Origin: 53A_R5_CA-02b.01 CPL-05_A06 a control assessment plan is developed that describes the scope of the assessment, including assessment procedures to be used to determine control effectiveness. Assessment rigor: 3 Origin: 53A_R5_CA-02b.02 CPL-05_A07 a control assessment plan is developed that describes the scope of the assessment, including the assessment environment. Assessment rigor: 3 Origin: 53A_R5_CA-02b.03[01] CPL-05_A08 a control assessment plan is developed that describes the scope of the assessment, including the assessment team. Assessment rigor: 3 Origin: 53A_R5_CA-02b.03[02] CPL-05_A09 a control assessment plan is developed that describes the scope of the assessment, including assessment roles and responsibilities. Assessment rigor: 3 Origin: 53A_R5_CA-02b.03[03] CPL-05_A10 the control assessment plan is reviewed and approved by the authorizing official or designated representative prior to conducting the assessment. Assessment rigor: 3 Origin: 53A_R5_CA-02c. CPL-05_A11 the security requirements for the system and its environment of operation are assessed <A.03.12.01.ODP[01]: frequency> to determine if the requirements have been satisfied. Defined parameters: at least every 12 months, or when there are significant incidents or significant changes to risks Assessment rigor: NIST 800-171 Origin: 171A_R3_A.03.12.01
CPL-05.1 Functional Review Of Security, Compliance & Resilience Controls – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CPL-05.1_A01 controls are assessed in the system and its environment of operation per an organization-defined assessment frequency to determine the extent to which the controls are implemented correctly, operating as intended and producing the desired outcome with respect to meeting established security requirements. Defined parameters: at least annually Assessment rigor: 1 Origin: 53A_R5_CA-02d.[01] CPL-05.1_A02 a control assessment report is produced that documents the results of the assessment. Assessment rigor: 1 Origin: 53A_R5_CA-02e. CPL-05.1_A03 controls are assessed in the system and its environment of operation per an organization-defined assessment frequency to determine the extent to which the controls are implemented correctly, operating as intended and producing the desired outcome with respect to meeting established privacy requirements. Defined parameters: at least annually Assessment rigor: 1 Origin: 53A_R5_CA-02d.[02] CPL-05.1_A04 the results of the control assessment are provided to individuals or roles. Assessment rigor: 3 Origin: 53A_R5_CA-02f. CPL-05.1_A05 a system-level continuous monitoring strategy is implemented. Assessment rigor: 2 Origin: 171A_R3_A.03.12.03[02]
CPL-06 Non-Conformity Oversight – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CPL-06_A01 instances of non-conformity with statutory, regulatory and/or contractual obligations are documented, including the reason(s) for non-conformity. Assessment rigor: 1 Origin: SCF Created CPL-06_A02 instances of non-conformity with statutory, regulatory and/or contractual obligations are formally reviewed to develop risk mitigation actions. Defined parameters: at least annually Assessment rigor: 1 Origin: SCF Created CPL-06_A03 instances of non-conformity with statutory, regulatory and/or contractual obligations are centrally governed to maintain situational awareness. Assessment rigor: 1 Origin: SCF Created CPL-06_A04 instances of non-conformity with statutory, regulatory and/or contractual obligations are assigned to individuals or teams for remediation. Assessment rigor: 1 Origin: SCF Created CPL-06_A05 risk mitigation actions for instances of non-conformity with statutory, regulatory and/or contractual obligations are documented. Assessment rigor: 1 Origin: SCF Created CPL-06_A06 instances of non-conformity with statutory, regulatory and/or contractual obligations are identified. Assessment rigor: 1 Origin: SCF Created
CPL-06.1 Non-Conformity Corrective Action – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CPL-06.1_A01 corrective action is implemented to remediate instances of non-conformity with applicable statutory, regulatory, and/or contractual compliance obligations. Defined parameters: within the remediation period required by the applicable statutory, regulatory or contractual obligation; otherwise per an organization-defined risk-based timeline Assessment rigor: 1 Origin: SCF Created
CPL-07 Executive Leadership Oversight of Security, Compliance & Resilience Controls – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CPL-07_A01 a compliance catalog of applicable laws, regulations and contractual obligations is documented. Assessment rigor: 1 Origin: SCF Created CPL-07_A02 a continuous monitoring strategy is developed for cybersecurity / data privacy controls. Assessment rigor: 1 Origin: 53A_R5_CA-07[01] CPL-07_A03 continuous control monitoring is implemented in accordance with the organization's continuous monitoring strategy. Assessment rigor: 1 Origin: 53A_R5_CA-07[02] CPL-07_A04 the frequency of cybersecurity / data privacy control assessments is defined. Defined parameters: at least every 12 months and after any significant incidents or significant changes occur Assessment rigor: 2 Origin: 171A_3.12.1[a] 53A_R5_CA-07_ODP[02] 53A_R5_CA-07_ODP[03] 53A_R5_CA-07b.[01] 53A_R5_CA-07b.[02] CPL-07_A05 cybersecurity / data privacy controls are assessed with the defined frequency to determine if the controls are effective in their application. Defined parameters: at least annually Assessment rigor: 2 Origin: 171A_3.12.1[b] 53A_R5_CA-07c. CPL-07_A06 cybersecurity / data privacy controls are monitored on an ongoing basis to ensure the continued effectiveness of those controls. Assessment rigor: 2 Origin: 171A_3.12.3 CPL-07_A07 personnel or roles to whom the cybersecurity / data privacy status of the system is reported are defined. Assessment rigor: 3 Origin: 53A_R5_CA-07_ODP[04] 53A_R5_CA-07_ODP[06] CPL-07_A08 the frequency at which the cybersecurity / data privacy status of the system is reported is defined. Defined parameters: at least annually Assessment rigor: 3 Origin: 53A_R5_CA-07_ODP[05] 53A_R5_CA-07_ODP[07] CPL-07_A09 system-level continuous monitoring includes reporting the cybersecurity / data privacy status of the system to pertinent personnel or roles according to an organization-defined frequency. Defined parameters: at least monthly Assessment rigor: 3 Origin: 53A_R5_CA-07g.[01] 53A_R5_CA-07g.[02] CPL-07_A10 control monitoring metrics are defined. Assessment rigor: 3 Origin: 53A_R5_CA-07_ODP[01] 53A_R5_CA-07a. CPL-07_A11 system-level continuous monitoring includes ongoing monitoring of system and organization-defined metrics in accordance with the continuous monitoring strategy. Assessment rigor: 3 Origin: 53A_R5_CA-07d. CPL-07_A12 system-level continuous monitoring includes correlation and analysis of information generated by control assessments and monitoring. Assessment rigor: 3 Origin: 53A_R5_CA-07e. CPL-07_A13 system-level continuous monitoring includes response actions to address the results of the analysis of control assessment and monitoring information. Assessment rigor: 3 Origin: 53A_R5_CA-07f. CPL-07_A14 the personnel or roles for reporting the security status of organizational systems to is/are defined. Assessment rigor: 3 Origin: 53A_R5_PM-31_ODP[04] CPL-07_A15 the personnel or roles for reporting the privacy status of organizational systems to is/are defined. Assessment rigor: 3 Origin: 53A_R5_PM-31_ODP[05] CPL-07_A16 the frequency at which to report the security status of organizational systems is defined. Defined parameters: at least quarterly Assessment rigor: 3 Origin: 53A_R5_PM-31_ODP[06] CPL-07_A17 the frequency at which to report the privacy status of organizational systems is defined. Defined parameters: at least quarterly Assessment rigor: 3 Origin: 53A_R5_PM-31_ODP[07] CPL-07_A18 an organization-wide continuous monitoring strategy is developed. Assessment rigor: 3 Origin: 53A_R5_PM-31 53A_R5_PM-31_ODP[01] CPL-07_A19 continuous monitoring programs are implemented that include establishing metrics to be monitored. Assessment rigor: 3 Origin: 53A_R5_PM-31a. CPL-07_A20 continuous monitoring programs are implemented that establish frequency for monitoring. Defined parameters: at least monthly Assessment rigor: 3 Origin: 53A_R5_PM-31b.[01] 53A_R5_PM-31_ODP[02] CPL-07_A21 continuous monitoring programs are implemented that establish frequency for assessment of control effectiveness. Defined parameters: at least annually Assessment rigor: 3 Origin: 53A_R5_PM-31b.[02] 53A_R5_PM-31_ODP[03] CPL-07_A22 continuous monitoring programs are implemented that include monitoring metrics on an ongoing basis in accordance with the continuous monitoring strategy. Assessment rigor: 3 Origin: 53A_R5_PM-31c. CPL-07_A23 continuous monitoring programs are implemented that include correlating information generated by control assessments and monitoring. Assessment rigor: 3 Origin: 53A_R5_PM-31d.[01] CPL-07_A24 continuous monitoring programs are implemented that include analyzing information generated by control assessments and monitoring. Assessment rigor: 3 Origin: 53A_R5_PM-31d.[02] CPL-07_A25 continuous monitoring programs are implemented that include response actions to address the analysis of control assessment information. Assessment rigor: 3 Origin: 53A_R5_PM-31e.[01] CPL-07_A26 continuous monitoring programs are implemented that include response actions to address the analysis of monitoring information. Assessment rigor: 3 Origin: 53A_R5_PM-31e.[02] CPL-07_A27 continuous monitoring programs are implemented that include reporting the security status of organizational systems to personnel or roles frequency. Defined parameters: at least quarterly Assessment rigor: 3 Origin: 53A_R5_PM-31f.[01] CPL-07_A28 continuous monitoring programs are implemented that include reporting the privacy status of organizational systems to personnel or roles frequency. Defined parameters: at least quarterly Assessment rigor: 3 Origin: 53A_R5_PM-31f.[02] CPL-07_A29 a system-level continuous monitoring strategy is developed. Assessment rigor: 2 Origin: 171A_R3_A.03.12.03[01] CPL-07_A30 ongoing monitoring is included in the continuous monitoring strategy. Assessment rigor: 2 Origin: 171A_R3_A.03.12.03[03] CPL-07_A31 security assessments are included in the continuous monitoring strategy. Assessment rigor: 2 Origin: 171A_R3_A.03.12.03[04]
CPL-07.1 Internal Audit Function – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CPL-07.1_A01 an internal audit function exists that is comprised of stakeholders who have the subject matter expertise to serve in an advisory capability on audit-related matters. Assessment rigor: 1 Origin: SCF Created CPL-07.1_A02 an internal audit function formally defines audit-related priorities for the organization. Assessment rigor: 1 Origin: SCF Created CPL-07.1_A03 an internal audit function tracks audit findings that require remediation efforts. Assessment rigor: 1 Origin: SCF Created CPL-07.1_A04 an internal audit function provides executive management with documented assessments of the overall management of the organization's security, compliance and resilience capabilities. Defined parameters: at least annually Assessment rigor: 1 Origin: SCF Created CPL-07.1_A05 the frequency at which to assess the security requirements for the system and its environment of operation is defined. Defined parameters: at least every 12 months and after any significant incidents or significant changes occur Assessment rigor: 2 Origin: 171A_R3_A.03.12.01.ODP[01]
CPL-07.2 Periodic Audits – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CPL-07.2_A01 the organization conducts formal audits of cybersecurity & data protection controls, per an organization-defined frequency, for conformity with the organization's policies, standards and procedures. Defined parameters: at least annually Assessment rigor: 3 Origin: SCF Created CPL-07.2_A02 responsibility for conducting conformity assessments is assigned to designated personnel or roles. Assessment rigor: 3 Origin: SCF Created
CPL-07.3 Audit Planning Activities – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CPL-07.3_A01 audit-related priorities are formally defined with input from operational risk and compliance partners. Assessment rigor: 1 Origin: SCF Created CPL-07.3_A02 audits are planned in a documented manner that minimizes the impact of audit-related activities on business operations. Assessment rigor: 1 Origin: SCF Created
CPL-08 Independent Assessors – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CPL-08_A01 independent assessors or assessment teams are employed to monitor in-scope controls on an ongoing basis. Assessment rigor: 1 Origin: 53A_R5_CA-07(01)
CPL-09 Assessment Team Subject Matter Expertise – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CPL-09_A01 based on the scope of an audit/assessment, necessary subject matter expertise is defined to perform review, interview and/or test activities for in-scope People, Processes, Technologies, Data and/or Facilities (PPTDF). Assessment rigor: 1 Origin: SCF Created CPL-09_A02 minimum professional qualifications to participate in an audit and/or assessment are defined. Assessment rigor: 1 Origin: SCF Created CPL-09_A03 auditors/assessors are evaluated for necessary subject matter expertise to perform an audit/assessment. Assessment rigor: 1 Origin: SCF Created CPL-09_A04 auditors/assessors are required to have minimum professional qualifications to participate in an audit/assessment. Assessment rigor: 1 Origin: SCF Created
CPL-10 Assessor Access – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CPL-10_A01 assessors are granted the minimum logical access authorizations necessary to conduct conformity assessments. Assessment rigor: 1 Origin: SCF Created CPL-10_A02 assessors are granted the minimum physical access authorizations necessary to conduct conformity assessments. Assessment rigor: 1 Origin: SCF Created
CPL-11 Assessment Methods – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CPL-11_A01 acceptable methods to conduct a cybersecurity and/or data protection assessment are defined. Assessment rigor: 1 Origin: SCF Created
CPL-12 Assessment Rigor – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CPL-12_A01 the level of assessment rigor necessary to conduct a cybersecurity and/or data protection assessment is defined. Assessment rigor: 1 Origin: SCF Created
CPL-13 Assurance Levels (AL) – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CPL-13_A01 Assurance Levels (AL) for assessment activities are defined to standardize assurance attributes. Assessment rigor: 1 Origin: SCF Created CPL-13_A02 Assurance Levels (AL) define depth criteria to address the rigor and level of detail of an assessment. Assessment rigor: 1 Origin: SCF Created CPL-13_A03 Assurance Levels (AL) define coverage criteria to address the scope and breadth of an assessment. Assessment rigor: 1 Origin: SCF Created
CPL-14 Control Reciprocity – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CPL-14_A01 instances of control reciprocity within assessment boundaries are defined. Assessment rigor: 1 Origin: SCF Created
CPL-15 Control Inheritance – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CPL-15_A01 instances of control inheritance within assessment boundaries are defined. Assessment rigor: 1 Origin: SCF Created
CPL-16 Evidence Request List (ERL) – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CPL-16_A01 an Evidence Request List (ERL) is defined prior to the start of a cybersecurity and/or data protection assessment. Assessment rigor: 1 Origin: SCF Created
CPL-17 Evidence Sampling – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CPL-17_A01 evidence sampling criteria for cybersecurity and/or data protection assessments are defined. Assessment rigor: 1 Origin: SCF Created
CPL-18 Continuous Control Monitoring (CCM) – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CPL-18_A01 the scope of Continuous Control Monitoring (CCM) is defined, including the Technology Assets, Applications, Services and Data (TAASD) and the security, compliance and resilience controls subject to monitoring. Assessment rigor: 1 Origin: SCF Created CPL-18_A02 Continuous Control Monitoring (CCM) is performed by automated mechanisms that assess and report the conformity status of the organization's Technology Assets, Applications, Services and Data (TAASD) against applicable security, compliance and resilience controls. Assessment rigor: 1 Origin: SCF Created
CPL-19 Legal Assessment of Investigative Inquires – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CPL-19_A01 a formal process exists to receive and document government agency data requests and to determine whether the agency has an applicable and valid legal basis for the request. Assessment rigor: 1 Origin: SCF Created CPL-19_A02 based on an applicable and valid legal basis for a data request by a government agency, data request fulfillment actions are formally assigned to an individual or group with explicitly-specified criteria that limit disclosure to the data the legal basis requires. Assessment rigor: 1 Origin: SCF Created
CPL-19.1 Investigation Request Notifications – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CPL-19.1_A01 a formal process exists to intake and document government investigation requests. Assessment rigor: 1 Origin: SCF Created CPL-19.1_A02 a formal process exists to evaluate government investigation requests for legal requirements the organization must comply with. Assessment rigor: 1 Origin: SCF Created CPL-19.1_A03 processes exist to notify affected customer(s) about investigation requests, unless the applicable legal basis for a government agency's action prohibits notification (e.g., potential criminal prosecution). Defined parameters: within the period permitted by the applicable legal authority, and no later than an organization-defined notification timeline Assessment rigor: 1 Origin: SCF Created
CPL-19.2 Investigation Access Restrictions – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CPL-19.2_A01 a formal process exists to intake and document government access requests. Assessment rigor: 1 Origin: SCF Created CPL-19.2_A02 a formal process exists to evaluate government access requests for legal requirements the organization must comply with. Assessment rigor: 1 Origin: SCF Created CPL-19.2_A03 government investigators are provisioned with least privileges and least functionality so that their access is limited to the Technology Assets, Applications, Services and/or Data (TAASD) needed to perform the investigation. Assessment rigor: 1 Origin: SCF Created
CPL-20 Government Surveillance – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CPL-20_A01 a formal process exists to intake and document access requests from host governments for unrestricted and unmonitored access to the organization's Technology Assets, Applications, Services and/or Data (TAASD) that could potentially violate other applicable statutory, regulatory and/or contractual obligations. Assessment rigor: 1 Origin: SCF Created CPL-20_A02 executive leadership, along with legal counsel, formally identifies risks associated with non-compliance, including at a minimum: fines and operational impacts. Assessment rigor: 1 Origin: SCF Created CPL-20_A03 executive leadership, along with legal counsel, formally identifies primary risks associated with compliance, including at a minimum: loss of confidentiality and/or integrity of the organization's data. Assessment rigor: 1 Origin: SCF Created CPL-20_A04 executive leadership, along with legal counsel, formally identifies secondary risks associated with compliance, including at a minimum: non-compliance with other laws, regulations and contractual agreements. Assessment rigor: 1 Origin: SCF Created CPL-20_A05 executive leadership, along with legal counsel, formally identifies tertiary risks associated with compliance, including at a minimum: human rights abuses, theft of intellectual property and espionage. Assessment rigor: 1 Origin: SCF Created CPL-20_A06 executive leadership, along with legal counsel, formally adopts an action plan to respond to host government requests for unrestricted and unmonitored access to the organization's Technology Assets, Applications, Services and/or Data (TAASD) that could potentially violate other applicable statutory, regulatory and/or contractual obligations. Assessment rigor: 1 Origin: SCF Created
CPL-21 Potential Human Rights Abuses – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CPL-21_A01 executive leadership, along with legal counsel, formally identifies risks associated with non-compliance (e.g., fines, operational impacts, etc.). Assessment rigor: 1 Origin: SCF Created CPL-21_A02 executive leadership, along with legal counsel, formally identifies primary risks associated with compliance (e.g., loss of confidentiality and/or integrity considerations with data governance). Assessment rigor: 1 Origin: SCF Created CPL-21_A03 executive leadership, along with legal counsel, formally identifies secondary risks associated with compliance (e.g., non-compliance with other laws, regulations and contractual agreements). Assessment rigor: 1 Origin: SCF Created CPL-21_A04 executive leadership, along with legal counsel, formally identifies tertiary risks associated with compliance (e.g., human rights abuses, theft of intellectual property, espionage, etc.). Assessment rigor: 1 Origin: SCF Created
CPL-22 Grievances – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CPL-22_A01 an intake mechanism exists to receive grievances related to the organization's cybersecurity and/or data protection practices. Assessment rigor: 1 Origin: SCF Created CPL-22_A02 received grievances are assigned to specific roles to investigate the legitimacy of the complaint. Assessment rigor: 1 Origin: SCF Created CPL-22_A03 the analysis of received grievances is documented. Assessment rigor: 1 Origin: SCF Created CPL-22_A04 upon validation of a grievance from a data subject, a process assigns the remediation task to an individual or team. Assessment rigor: 1 Origin: SCF Created
CPL-22.1 Grievance Response – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CPL-22.1_A01 responses are provided to legitimate grievances related to the organization's cybersecurity and/or data protection practices. Defined parameters: within the response period required by the applicable data protection law or contract, and otherwise per an organization-defined response timeline Assessment rigor: 1 Origin: SCF Created
CPL-23 Localized Representation – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CPL-23_A01 localized representation with a physical presence in the host country is appointed to represent the organization, as required by applicable laws and/or regulations. Assessment rigor: 1 Origin: SCF Created
CPL-23.1 Representative Powers – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CPL-23.1_A01 localized representation is contracted to perform specified functions in regard to representing statutory and/or regulatory compliance matters in the host country. Assessment rigor: 1 Origin: SCF Created
CPL-24 Dual Use Technology – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CPL-24_A01 technologies and/or data that have potential "dual-use" capabilities for civil and military applications are identified. Assessment rigor: 1 Origin: SCF Created CPL-24_A02 technologies and/or data that have potential use by terrorists are identified. Assessment rigor: 1 Origin: SCF Created CPL-24_A03 technologies and/or data that have potential Weapons of Mass Destruction (WMD) applications are identified. Assessment rigor: 1 Origin: SCF Created
CPL-24.1 USML or CCL Identification – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CPL-24.1_A01 whether the organization handles United States Munitions List (USML) or Commerce Control List (CCL) items or technical data, or provides defense services, is determined. Assessment rigor: 1 Origin: SCF Created
CPL-24.2 Export-Controlled Access Restrictions – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CPL-24.2_A01 logical access to United States (US) export-controlled data is restricted to US citizens. Assessment rigor: 1 Origin: SCF Created CPL-24.2_A02 logical access to United States (US) export-controlled data is restricted to US Green Card holders. Assessment rigor: 1 Origin: SCF Created CPL-24.2_A03 physical access to United States (US) export-controlled data is restricted to US citizens. Assessment rigor: 1 Origin: SCF Created CPL-24.2_A04 physical access to United States (US) export-controlled data is restricted to US Green Card holders. Assessment rigor: 1 Origin: SCF Created
CPL-24.3 Export Activities Documentation – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CPL-24.3_A01 detailed logs of export-controlled data are generated to document logical and physical access. Defined parameters: no less than 5 years Assessment rigor: 1 Origin: SCF Created CPL-24.3_A02 detailed logs of export-controlled data are generated to document export activities. Defined parameters: no less than 5 years Assessment rigor: 1 Origin: SCF Created
CPL-25 Statement of Applicability (SOA) – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CPL-25_A01 applicable controls for an audit/assessment are identified. Assessment rigor: 1 Origin: SCF Created CPL-25_A02 a Statement of Applicability (SOA), or similar document, is generated to formalize audit/assessment control scoping. Assessment rigor: 1 Origin: SCF Created
CPL-26 Work Products – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CPL-26_A01 work products (e.g., process artifacts) necessary to demonstrate conformity with applicable requirements are defined. Assessment rigor: 1 Origin: SCF Created CPL-26_A02 work products (e.g., process artifacts) necessary to demonstrate conformity with applicable requirements are generated and retained. Defined parameters: the retention period required by the applicable statutory, regulatory or contractual obligation, and at a minimum through the completion of the next audit or assessment cycle Assessment rigor: 1 Origin: SCF Created
CPL-26.1 Defensible Evidence of Due Diligence – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CPL-26.1_A01 the minimum threshold for evidence of due diligence activities capable of withstanding external audit or regulatory scrutiny is defined. Assessment rigor: 1 Origin: SCF Created CPL-26.1_A02 evidence of due diligence activities is generated and retained to demonstrate conformity with applicable requirements. Defined parameters: the retention period required by the applicable statutory, regulatory or contractual obligation, and at a minimum through the completion of the next audit or assessment cycle Assessment rigor: 1 Origin: SCF Created
CPL-26.2 Defensible Evidence of Due Care – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CPL-26.2_A01 the minimum threshold for evidence of due care activities capable of withstanding external audit or regulatory scrutiny is defined. Assessment rigor: 1 Origin: SCF Created CPL-26.2_A02 evidence of due care activities is generated and retained to demonstrate conformity with applicable requirements. Defined parameters: the retention period required by the applicable statutory, regulatory or contractual obligation, and at a minimum through the completion of the next audit or assessment cycle Assessment rigor: 1 Origin: SCF Created
CPL-27 Security, Compliance & Resilience Status Reporting – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CPL-27_A01 applicable statutory and/or regulatory authorities that require submissions of the organization's cybersecurity and/or data privacy program status are identified. Defined parameters: at least annually Assessment rigor: 1 Origin: SCF Created CPL-27_A02 contact information and report formatting requirements for applicable statutory and/or regulatory authorities are identified. Assessment rigor: 1 Origin: SCF Created CPL-27_A03 a documented process exists to submit status reporting of the organization's cybersecurity and/or data privacy program to applicable statutory and/or regulatory authorities, as required. Defined parameters: the submission deadline set by the applicable statutory or regulatory authority Assessment rigor: 1 Origin: SCF Created CPL-27_A04 evidence of historical submissions of the organization's cybersecurity and/or data privacy program status to applicable statutory and/or regulatory authorities is retained. Defined parameters: the retention period required by the applicable statutory, regulatory or contractual obligation Assessment rigor: 1 Origin: SCF Created
CPL-28 AI & Autonomous Technologies Registration – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CPL-28_A01 the organization identifies the governing bodies that require registration of Artificial Intelligence (AI) and Autonomous Technologies (AAT) under applicable statutory or regulatory requirements. Assessment rigor: 1 Origin: SCF Created CPL-28_A02 the organization maintains a current registration for Artificial Intelligence (AI) and Autonomous Technologies (AAT) with each governing body required by applicable statutory or regulatory requirements. Defined parameters: no later than the renewal deadline set by the applicable governing body Assessment rigor: 1 Origin: SCF Created
CPL-29 Control Assurance Automation (CAA) Oversight – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CPL-29_A01 Control Assurance Automation (CAA) engineering pipelines, tooling and automated collection are identified and documented as technology functions within the scope of the organization's governance. Assessment rigor: 1 Origin: SCF Created CPL-29_A02 Control Assurance Automation (CAA) engineering pipelines, tooling and automated collection are included in the organization's risk assessment and risk register activities in the same manner as other technology functions. Assessment rigor: 1 Origin: SCF Created CPL-29_A03 Control Assurance Automation (CAA) engineering pipelines, tooling and automated collection are subject to the same governance requirements applied to other technology functions, including ownership, access management, change management and monitoring. Assessment rigor: 2 Origin: SCF Created CPL-29_A04 responsibility and authority for the governance and risk oversight of Control Assurance Automation (CAA) are assigned to designated personnel. Assessment rigor: 1 Origin: SCF Created CPL-29_A05 governance and risk oversight of Control Assurance Automation (CAA) is reviewed at a defined frequency. Defined parameters: at least annually Assessment rigor: 1 Origin: SCF Created
CPL-30 Control Assurance Automation (CAA) Evidence Integrity & Provenance – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CPL-30_A01 chain of custody for logs, telemetry and evidence collected by Control Assurance Automation (CAA) is documented from source to repository, including the collecting mechanism, the source and the time of collection. Assessment rigor: 1 Origin: SCF Created CPL-30_A02 the integrity of logs, telemetry and evidence collected by Control Assurance Automation (CAA) is verified upon transfer from source to repository (e.g., hash comparison, record counts or digital signatures) and transfer failures or mismatches are recorded and investigated. Assessment rigor: 2 Origin: SCF Created CPL-30_A03 logs, telemetry and evidence collected by Control Assurance Automation (CAA) are stored in tamper-evident storage (e.g., cryptographic hashing, append-only or immutable storage) that allows unauthorized modification or deletion to be detected. Assessment rigor: 1 Origin: SCF Created CPL-30_A04 access to the Control Assurance Automation (CAA) evidence repository is restricted to authorized personnel and access and modification attempts are logged. Assessment rigor: 1 Origin: SCF Created CPL-30_A05 integrity verification records for Control Assurance Automation (CAA) evidence are retained for as long as the evidence itself is retained. Assessment rigor: 3 Origin: SCF Created
CFG-01 Configuration Management Policy – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CFG-01_A01 a formal, documented configuration management policy is approved by executive management, or a formally delegated authority, and conveys executive management's intent for configuration management. Assessment rigor: 1 Origin: SCF Created CFG-01_A02 the configuration management policy provides organizational direction and states the behaviors expected of personnel and other applicable parties with respect to configuration management. Assessment rigor: 1 Origin: SCF Created CFG-01_A03 the current version of the configuration management policy is communicated to, and accessible by, the personnel and other applicable parties who are expected to comply with it. Assessment rigor: 1 Origin: SCF Created CFG-01_A04 the configuration management policy is reviewed at least annually. Defined parameters: at least annually Assessment rigor: 1 Origin: SCF Created CFG-01_A05 the configuration management policy is updated, as necessary, in response to changes in risks, threats, business practices and/or statutory, regulatory and contractual obligations that affect the organization. Assessment rigor: 1 Origin: SCF Created
CFG-02 Configuration Management Program – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CFG-02_A01 the scope for the configuration management plan is organization-wide. Assessment rigor: 1 Origin: 53A_R5_CM-01_ODP[03] CFG-02_A02 the types of changes to the system that are configuration-controlled are defined. Assessment rigor: 1 Origin: 171A_R3_A.03.04.03.a CFG-02_A03 a configuration management plan for systems, applications and services is developed and documented. Assessment rigor: 1 Origin: 53A_R5_CM-09[01] CFG-02_A04 a configuration management plan for systems, applications and services is implemented. Assessment rigor: 1 Origin: 53A_R5_CM-09[02] CFG-02_A05 the current configuration management policy is reviewed / updated organization-defined frequency. Defined parameters: at least annually Assessment rigor: 3 Origin: 53A_R5_CM-01c.01[01] CFG-02_A06 the current configuration management policy is reviewed / updated following organization-defined events. Defined parameters: significant changes Assessment rigor: 3 Origin: 53A_R5_CM-01c.01[02] CFG-02_A07 personnel or roles to review and approve the configuration management plan is/are defined. Assessment rigor: 3 Origin: 53A_R5_CM-09_ODP CFG-02_A08 the configuration management plan addresses roles. Assessment rigor: 3 Origin: 53A_R5_CM-09a.[01] CFG-02_A09 the configuration management plan addresses responsibilities. Assessment rigor: 3 Origin: 53A_R5_CM-09a.[02] CFG-02_A10 the configuration management plan addresses configuration management processes and procedures. Assessment rigor: 3 Origin: 53A_R5_CM-09a.[03] CFG-02_A11 the configuration management plan establishes a process for identifying configuration items throughout the system development life cycle. Assessment rigor: 3 Origin: 53A_R5_CM-09b.[01] CFG-02_A12 the configuration management plan establishes a process for managing the configuration of the configuration items. Assessment rigor: 3 Origin: 53A_R5_CM-09b.[02] CFG-02_A13 the configuration management plan defines the configuration items for the system. Assessment rigor: 3 Origin: 53A_R5_CM-09c.[01] CFG-02_A14 the configuration management plan places the configuration items under configuration management. Assessment rigor: 3 Origin: 53A_R5_CM-09c.[02] CFG-02_A15 the configuration management plan is reviewed and approved by organization-defined personnel or roles. Assessment rigor: 3 Origin: 53A_R5_CM-09d. CFG-02_A16 the configuration management plan is protected from unauthorized disclosure. Assessment rigor: 3 Origin: 53A_R5_CM-09e.[01] CFG-02_A17 the configuration management plan is protected from unauthorized modification. Assessment rigor: 3 Origin: 53A_R5_CM-09e.[02] CFG-02_A18 configuration management operations are conducted according to documented policies, standards, procedures and/or other organizational directives. Assessment rigor: 1 Origin: SCF Created CFG-02_A19 resources are provided to support configuration management operations, including at a minimum: people, processes, technologies, data and facilities. Assessment rigor: 1 Origin: SCF Created CFG-02_A20 responsibility and authority for the performance of configuration management-related activities are assigned to designated personnel. Assessment rigor: 1 Origin: SCF Created CFG-02_A21 personnel performing configuration management-related activities have the skills and knowledge needed to perform their assigned duties. Assessment rigor: 2 Origin: SCF Created
CFG-03 Least Functionality – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CFG-03_A01 configuration settings for the system that reflect the most restrictive mode consistent with operational requirements are defined (e.g., principle of least functionality). Assessment rigor: 1 Origin: 171A_3.4.6[a] 53A_R5_CM-07_ODP[01] CFG-03_A02 systems are configured to provide only the defined essential capabilities, where unnecessary or nonsecure functions, ports, protocols, connections, and services are disabled or removed. Assessment rigor: 1 Origin: 171A_3.4.6[b] 53A_R5_CM-07a. CFG-03_A03 functions to be prohibited or restricted are defined. Assessment rigor: 2 Origin: 53A_R5_CM-07_ODP[02] CFG-03_A04 ports to be prohibited or restricted are defined. Assessment rigor: 2 Origin: 53A_R5_CM-07_ODP[03] CFG-03_A05 protocols to be prohibited or restricted are defined. Assessment rigor: 2 Origin: 53A_R5_CM-07_ODP[04] CFG-03_A06 software to be prohibited or restricted is defined. Assessment rigor: 2 Origin: 53A_R5_CM-07_ODP[05] CFG-03_A07 services to be prohibited or restricted are defined. Assessment rigor: 2 Origin: 53A_R5_CM-07_ODP[06] CFG-03_A08 the use of organization-defined functions is prohibited or restricted. Assessment rigor: 2 Origin: 53A_R5_CM-07b.[01] CFG-03_A09 the use of organization-defined ports is prohibited or restricted. Assessment rigor: 2 Origin: 53A_R5_CM-07b.[02] CFG-03_A10 the use of organization-defined protocols is prohibited or restricted. Assessment rigor: 2 Origin: 53A_R5_CM-07b.[03] CFG-03_A11 the use of organization-defined software is prohibited or restricted. Assessment rigor: 2 Origin: 53A_R5_CM-07b.[04] CFG-03_A12 the use of organization-defined services is prohibited or restricted. Assessment rigor: 2 Origin: 53A_R5_CM-07b.[05] CFG-03_A13 configuration settings for the system reflect the most restrictive mode consistent with operational requirements are defined. Assessment rigor: 2 Origin: 171A_R3_A.03.04.02.ODP[01] CFG-03_A14 unnecessary or nonsecure functions, ports, protocols, connections, and services are disabled or removed. Assessment rigor: 2 Origin: 171A_R3_A.03.04.06.d
CFG-03.1 Baseline Tailoring – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CFG-03.1_A01 secure baseline configurations are tailored by applying the defined set of tailoring actions. Assessment rigor: 1 Origin: 53A_R5_PL-11 CFG-03.1_A02 additional information for audit records is provided, as needed. Assessment rigor: 2 Origin: 171A_R3_A.03.03.02.b
CFG-03.2 Development & Test Environment Configurations – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CFG-03.2_A01 a secure baseline configuration for development environments that is managed separately from the operational baseline configuration is maintained. Assessment rigor: 1 Origin: 53A_R5_CM-02(06)[01] CFG-03.2_A02 a secure baseline configuration for test environments that is managed separately from the operational baseline configuration is maintained. Assessment rigor: 1 Origin: 53A_R5_CM-02(06)[02]
CFG-04 Secure Baseline Configurations – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CFG-04_A01 a current baseline configuration for systems, applications and services is developed and documented. Assessment rigor: 1 Origin: 171A_3.4.1[a] 171A_3.4.2[a] 53A_R5_CM-02a.[01] CFG-04_A02 the baseline configuration includes hardware, software, firmware and documentation. Assessment rigor: 1 Origin: 171A_3.4.1[b] CFG-04_A03 security configuration settings for information technology products employed in the system are enforced. Assessment rigor: 1 Origin: 171A_3.4.2[b] 53A_R5_CM-06b. CFG-04_A04 the baseline configuration is maintained (reviewed / updated) throughout the system development life cycle under configuration control. Assessment rigor: 1 Origin: 171A_3.4.1[c] 53A_R5_CM-02a.[02] CFG-04_A05 configuration settings that reflect the most restrictive mode consistent with operational requirements are established and documented for components employed within the system using organization-defined common secure configurations. Assessment rigor: 1 Origin: 53A_R5_CM-06a. CFG-04_A06 thresholds to which attack surfaces are to be reduced are defined. Assessment rigor: 2 Origin: 53A_R5_SA-15(05)_ODP CFG-04_A07 the developer of the system, system component or system service is required to reduce attack surfaces to organization-defined thresholds. Assessment rigor: 2 Origin: 53A_R5_SA-15(05) CFG-04_A08 a control baseline for the system is selected. Assessment rigor: 3 Origin: 53A_R5_PL-10 CFG-04_A09 approved authorizations are enforced for controlling the flow of CUI within the system. Assessment rigor: NIST 800-171 Origin: 171A_R3_A.03.01.03[01] CFG-04_A10 configuration requirements are established for each type of wireless access to the system. Assessment rigor: 2 Origin: 171A_R3_A.03.01.16.a[03] CFG-04_A11 wireless networking capabilities not intended for use are disabled prior to issuance and deployment. Assessment rigor: 2 Origin: 171A_R3_A.03.01.16.c CFG-04_A12 configuration requirements are established for mobile devices. Assessment rigor: 2 Origin: 171A_R3_A.03.01.18.a[02] CFG-04_A13 audit logging tools are protected from unauthorized access, modification, and deletion. Assessment rigor: 2 Origin: 171A_3.3.8[d] 171A_3.3.8[e] 171A_3.3.8[f] 171A_R3_A.03.03.08.a[02] CFG-04_A14 a current baseline configuration of the system is developed. Assessment rigor: 2 Origin: 171A_R3_A.03.04.01.a[01] CFG-04_A15 a current baseline configuration of the system is maintained under configuration control. Assessment rigor: 2 Origin: 171A_R3_A.03.04.01.a[02] CFG-04_A16 the following configuration settings for the system that reflect the most restrictive mode consistent with operational requirements are established and documented: <A.03.04.02.ODP[01]: configuration settings>. Defined parameters: Apply the appropriate use of common security configurations available from the National Institute of Standards and Technology’s National Checklist Program (NCP) website (https://ncp.nist.gov/repository) and prevent remote devices from simultaneously establishing nonremote connections with organizational systems and communicating via some other unauthorized connection to resources in external networks. Document any deviations from the published standard or source document. Assessment rigor: NIST 800-171 Origin: 171A_R3_A.03.04.02.a[01] CFG-04_A17 the following configuration settings for the system are implemented: <A.03.04.02.ODP[01]: configuration settings>. Defined parameters: Apply the appropriate use of common security configurations available from the National Institute of Standards and Technology’s National Checklist Program (NCP) website (https://ncp.nist.gov/repository) and prevent remote devices from simultaneously establishing nonremote connections with organizational systems and communicating via some other unauthorized connection to resources in external networks. Document any deviations from the published standard or source document. Assessment rigor: NIST 800-171 Origin: 171A_R3_A.03.04.02.a[02] CFG-04_A18 functions to be prohibited or restricted are defined. Assessment rigor: 2 Origin: 171A_R3_A.03.04.06.ODP[01] CFG-04_A19 ports to be prohibited or restricted are defined. Assessment rigor: 2 Origin: 171A_R3_A.03.04.06.ODP[02] CFG-04_A20 protocols to be prohibited or restricted are defined. Assessment rigor: 2 Origin: 171A_R3_A.03.04.06.ODP[03] CFG-04_A21 connections to be prohibited or restricted are defined. Assessment rigor: 2 Origin: 171A_R3_A.03.04.06.ODP[04] CFG-04_A22 services to be prohibited or restricted are defined. Assessment rigor: 2 Origin: 171A_R3_A.03.04.06.ODP[05] CFG-04_A23 the use of the following functions is prohibited or restricted: <A.03.04.06.ODP[01]: functions>. Defined parameters: Guidance: Where feasible, organizations should limit component functionality to a single function per component. Organizations should consider removing unused or unnecessary software and disabling unused or unnecessary physical and logical ports and protocols to prevent unauthorized connection of components, transfer of information, and tunneling. Organizations should employ network scanning tools, intrusion detection and prevention systems, and endpoint protection technologies, such as firewalls and host-based intrusion detection systems, to identify and prevent the use of prohibited functions, protocols, ports, and services. Least functionality should also be achieved as part of the fundamental design and development of the system. Assessment rigor: NIST 800-171 Origin: 171A_R3_A.03.04.06.b[01] CFG-04_A24 the use of the following ports is prohibited or restricted: <A.03.04.06.ODP[02]: ports>. Defined parameters: Guidance: Where feasible, organizations should limit component functionality to a single function per component. Organizations should consider removing unused or unnecessary software and disabling unused or unnecessary physical and logical ports and protocols to prevent unauthorized connection of components, transfer of information, and tunneling. Organizations should employ network scanning tools, intrusion detection and prevention systems, and endpoint protection technologies, such as firewalls and host-based intrusion detection systems, to identify and prevent the use of prohibited functions, protocols, ports, and services. Least functionality should also be achieved as part of the fundamental design and development of the system. Assessment rigor: NIST 800-171 Origin: 171A_R3_A.03.04.06.b[02] CFG-04_A25 the use of the following protocols is prohibited or restricted: <A.03.04.06.ODP[03]: protocols>. Defined parameters: Guidance: Where feasible, organizations should limit component functionality to a single function per component. Organizations should consider removing unused or unnecessary software and disabling unused or unnecessary physical and logical ports and protocols to prevent unauthorized connection of components, transfer of information, and tunneling. Organizations should employ network scanning tools, intrusion detection and prevention systems, and endpoint protection technologies, such as firewalls and host-based intrusion detection systems, to identify and prevent the use of prohibited functions, protocols, ports, and services. Least functionality should also be achieved as part of the fundamental design and development of the system. Assessment rigor: NIST 800-171 Origin: 171A_R3_A.03.04.06.b[03] CFG-04_A26 the use of the following connections is prohibited or restricted: <A.03.04.06.ODP[04]: connections>. Defined parameters: Guidance: Where feasible, organizations should limit component functionality to a single function per component. Organizations should consider removing unused or unnecessary software and disabling unused or unnecessary physical and logical ports and protocols to prevent unauthorized connection of components, transfer of information, and tunneling. Organizations should employ network scanning tools, intrusion detection and prevention systems, and endpoint protection technologies, such as firewalls and host-based intrusion detection systems, to identify and prevent the use of prohibited functions, protocols, ports, and services. Least functionality should also be achieved as part of the fundamental design and development of the system. Assessment rigor: NIST 800-171 Origin: 171A_R3_A.03.04.06.b[04] CFG-04_A27 the use of the following services is prohibited or restricted: <A.03.04.06.ODP[05]: services>. Defined parameters: Guidance: Where feasible, organizations should limit component functionality to a single function per component. Organizations should consider removing unused or unnecessary software and disabling unused or unnecessary physical and logical ports and protocols to prevent unauthorized connection of components, transfer of information, and tunneling. Organizations should employ network scanning tools, intrusion detection and prevention systems, and endpoint protection technologies, such as firewalls and host-based intrusion detection systems, to identify and prevent the use of prohibited functions, protocols, ports, and services. Least functionality should also be achieved as part of the fundamental design and development of the system. Assessment rigor: NIST 800-171 Origin: 171A_R3_A.03.04.06.b[05] CFG-04_A28 replay-resistant authentication mechanisms for access to privileged accounts are implemented. Assessment rigor: 2 Origin: 171A_R3_A.03.05.04[01] CFG-04_A29 replay-resistant authentication mechanisms for access to non-privileged accounts are implemented. Assessment rigor: 2 Origin: 171A_R3_A.03.05.04[02] CFG-04_A30 passwords are only transmitted over cryptographically protected channels. Assessment rigor: 2 Origin: 171A_R3_A.03.05.07.c CFG-04_A31 passwords are stored in a cryptographically protected form. Assessment rigor: 2 Origin: 171A_R3_A.03.05.07.d CFG-04_A32 a new password is selected upon first use after account recovery. Assessment rigor: 2 Origin: 171A_R3_A.03.05.07.e CFG-04_A33 organization-defined composition and complexity rules for passwords are enforced. Defined parameters: no fewer than 12 characters Assessment rigor: 3 Origin: SCF Created CFG-04_A34 replay resistance is implemented in the establishment of nonlocal maintenance and diagnostic sessions. Assessment rigor: 2 Origin: 171A_R3_A.03.07.05.b[02] CFG-04_A35 the following composition and complexity rules for passwords are enforced: <A.03.05.07.ODP[02]: rules>. Defined parameters: SDP values: (1) Must have a minimum length of 16 characters. (2) Contains a string of characters that does not include the user’s account name or full name. Assessment rigor: NIST 800-171 Origin: 171A_R3_A.03.05.07.f
CFG-04.1 Account Lockout – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CFG-04.1_A01 the means of limiting unsuccessful logon attempts is defined. Assessment rigor: 1 Origin: 171A_3.1.8[a] CFG-04.1_A02 the defined means of limiting unsuccessful logon attempts is implemented. Assessment rigor: 1 Origin: 171A_3.1.8[b] CFG-04.1_A03 the number of consecutive invalid logon attempts by a user allowed during a time period is defined. Assessment rigor: 1 Origin: 53A_R5_AC-07_ODP[01] 171A_R3_A.03.01.08.ODP[01] CFG-04.1_A04 <A.03.01.08.ODP[03]: SELECTED PARAMETER VALUES> when the maximum number of unsuccessful attempts is exceeded. Defined parameters: Select one or more: - lock the account or node for an at least 15- minute time period; - lock the account or node until released by an administrator and notify a system administrator Assessment rigor: NIST 800-171 Origin: 53A_R5_AC-07b. 171A_R3_A.03.01.08.b CFG-04.1_A05 the time period to which the number of consecutive invalid logon attempts by a user is limited is defined. Assessment rigor: 2 Origin: 53A_R5_AC-07_ODP[02] 171A_R3_A.03.01.08.ODP[02] CFG-04.1_A06 the time period for an account or node to be locked is defined (if selected). Assessment rigor: 2 Origin: 53A_R5_AC-07_ODP[04] 171A_R3_A.03.01.08.ODP[04] CFG-04.1_A07 delay algorithm for the next logon prompt is defined. Assessment rigor: 3 Origin: 53A_R5_AC-07_ODP[05] CFG-04.1_A08 other action to be taken when the maximum number of unsuccessful attempts is exceeded is defined. Assessment rigor: 3 Origin: 53A_R5_AC-07_ODP[03] 53A_R5_AC-07_ODP[06] CFG-04.1_A09 a limit of <A.03.01.08.ODP[01]: number> consecutive invalid logon attempts by a user during <A.03.01.08.ODP[02]: time period> is enforced. Defined parameters: SDP values: [01] - at most five (5) [02] - period of five (5) minutes Assessment rigor: NIST 800-171 Origin: 53A_R5_AC-07a. 171A_R3_A.03.01.08.a CFG-04.1_A10 one or more of the following PARAMETER VALUES are selected: {the account or node is locked automatically for <A.03.01.08.ODP[04]: time period>; the account or node is locked automatically until released by an administrator; the next logon prompt is delayed automatically; the system administrator is notified automatically; other action is taken automatically}. Defined parameters: at least 15- minute time period Assessment rigor: NIST 800-171 Origin: 171A_R3_A.03.01.08.ODP[03]
CFG-04.2 Concurrent Session Control – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CFG-04.2_A01 accounts and/or account types for which to limit the number of concurrent sessions is defined. Defined parameters: privileged and non-privileged Assessment rigor: 1 Origin: 53A_R5_AC-10_ODP[01] CFG-04.2_A02 the number of concurrent sessions to be allowed for each account and/or account type is defined. Defined parameters: three (3) sessions for privileged access and two (2) sessions for non-privileged access Assessment rigor: 1 Origin: 53A_R5_AC-10_ODP[02] CFG-04.2_A03 the number of concurrent sessions for each organization-defined account and/or account types is limited to organization-defined number. Defined parameters: three (3) sessions for privileged access and two (2) sessions for non-privileged access Assessment rigor: 1 Origin: 53A_R5_AC-10
CFG-04.3 Session Lock – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CFG-04.3_A01 the period of inactivity after which the system initiates a session lock is defined. Defined parameters: fifteen (15) minutes Assessment rigor: 1 Origin: 171A_3.1.10[a] CFG-04.3_A02 access to the system and viewing of data is prevented by initiating a session lock after the defined period of inactivity. Assessment rigor: 1 Origin: 171A_3.1.10[b] CFG-04.3_A03 previously visible information is concealed via a pattern-hiding display after the defined period of inactivity. Assessment rigor: 1 Origin: 171A_3.1.10[c] CFG-04.3_A04 the time period of expected inactivity or description of when to log out is defined. Defined parameters: When inactivity is anticipated to exceed Fifteen (15) minutes. For privileged users, it is also the end of a user's standard work period. Assessment rigor: 3 Origin: 53A_R5_AC-02(05)_ODP CFG-04.3_A05 users are required to log out when organization-defined time period of expected inactivity or description of when to log out. Defined parameters: When inactivity is anticipated to exceed Fifteen (15) minutes. For privileged users, it is also the end of a user's standard work period. Assessment rigor: 3 Origin: 53A_R5_AC-02(05) CFG-04.3_A06 the time period of inactivity after which a device lock is initiated is defined (if selected). Defined parameters: fifteen (15) minutes Assessment rigor: 2 Origin: 53A_R5_AC-11_ODP[01] 53A_R5_AC-11_ODP[02] 171A_R3_A.03.01.10.ODP[02] CFG-04.3_A07 access to the system is prevented by <A.03.01.10.ODP[01]: SELECTED PARAMETER VALUES>. Defined parameters: initiating a device lock after “at most 15 minutes” of inactivity and requiring the user to initiate a device lock before leaving the system unattended Assessment rigor: NIST 800-171 Origin: 53A_R5_AC-11a. 171A_R3_A.03.01.10.a CFG-04.3_A08 the device lock is retained until the user reestablishes access using established identification and authentication procedures. Assessment rigor: 2 Origin: 53A_R5_AC-11b. 171A_R3_A.03.01.10.b CFG-04.3_A09 one or more of the following PARAMETER VALUES are selected: {a device lock is initiated after <A.03.01.10.ODP[02]: time period> of inactivity; the user is required to initiate a device lock before leaving the system unattended}. Defined parameters: at most 15- minute time period Assessment rigor: NIST 800-171 Origin: 171A_R3_A.03.01.10.ODP[01]
CFG-04.4 Pattern-Hiding Displays – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CFG-04.4_A01 information previously visible on the display is concealed via device lock with a publicly viewable image. Defined parameters: requiring the user to initiate a device lock before leaving the system unattended. Assessment rigor: 1 Origin: 53A_R5_AC-11(01) 171A_R3_A.03.01.10.c
CFG-04.5 Session Termination – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CFG-04.5_A01 conditions requiring a user session to terminate are defined. Assessment rigor: 1 Origin: 171A_3.1.11[a] CFG-04.5_A02 conditions or trigger events that require session disconnect are defined. Assessment rigor: 1 Origin: 171A_3.1.11[b] 171A_R3_A.03.01.11.ODP[01] 53A_R5_AC-12_ODP CFG-04.5_A03 a user session is automatically terminated after any of the defined conditions occur. Assessment rigor: 1 Origin: 53A_R5_AC-12 171A_3.1.11[b] CFG-04.5_A04 the time period of expected inactivity requiring users to log out of the system is defined. Assessment rigor: 2 Origin: 171A_R3_A.03.01.01.ODP[05] CFG-04.5_A05 circumstances requiring users to log out of the system are defined. Assessment rigor: 2 Origin: 171A_R3_A.03.01.01.ODP[06] CFG-04.5_A06 users are required to log out of the system after <A.03.01.01.ODP[05]: time period> of expected inactivity or when the following circumstances occur: <A.03.01.01.ODP[06]: circumstances>. Defined parameters: SDP values: [05] - at most 24 hours [06] - the work period ends, for privileged users at a minimum Assessment rigor: NIST 800-171 Origin: 171A_R3_A.03.01.01.h CFG-04.5_A07 session connections are terminated when nonlocal maintenance is completed. Assessment rigor: 2 Origin: 171A_R3_A.03.07.05.c[01] CFG-04.5_A08 a user session is terminated automatically after <A.03.01.11.ODP[01]: conditions or trigger events>. Defined parameters: a specified duration (maximum of 24 hours) of inactivity, misbehavior (end the session due to an attempted policy violation), and maintenance (terminate sessions to prevent issues with an upgrade or service outage) Assessment rigor: NIST 800-171 Origin: 171A_R3_A.03.01.11
CFG-04.6 User-Initiated Logouts / Message Displays – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CFG-04.6_A01 information resources for which a logout capability for user-initiated communications sessions is required are defined. Assessment rigor: 1 Origin: 53A_R5_AC-12(01)_ODP CFG-04.6_A02 a logout capability is provided for user-initiated communications sessions whenever authentication is used to gain access to organization-defined information resources. Assessment rigor: 1 Origin: 53A_R5_AC-12(01)
CFG-04.7 Non-Console Administrative Access – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CFG-04.7_A01 cryptographic mechanisms are utilized to protect the confidentiality and integrity of non-console administrative access. Assessment rigor: 1 Origin: SCF Created
CFG-04.8 Wireless Access Authentication & Encryption – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CFG-04.8_A01 configuration requirements are established for each type of wireless access. Assessment rigor: 1 Origin: 53A_R5_AC-18a.[01] CFG-04.8_A02 connection requirements are established for each type of wireless access. Assessment rigor: 3 Origin: 53A_R5_AC-18a.[02] CFG-04.8_A03 implementation guidance is established for each type of wireless access. Assessment rigor: 3 Origin: 53A_R5_AC-18a.[03]
CFG-04.9 Bluetooth & Wireless Devices – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CFG-04.9_A01 the possession of unauthorized Bluetooth and wireless devices (e.g., Near Field Communications (NFC)) is prohibited in sensitive areas. Assessment rigor: 1 Origin: SCF Created CFG-04.9_A02 the usage of Bluetooth and wireless devices (e.g., Near Field Communications (NFC)) is prohibited in sensitive areas, unless use is in a Radio Frequency (RF)-screened building. Assessment rigor: 1 Origin: SCF Created
CFG-04.10 Infrared Communications – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CFG-04.10_A01 the possession of unauthorized Infrared (IR) communications devices is prohibited in sensitive areas. Assessment rigor: 1 Origin: SCF Created CFG-04.10_A02 Infrared (IR) communications are configured to prevent line of sight and reflected use in unsecured spaces. Assessment rigor: 1 Origin: SCF Created
CFG-04.11 Microphones & Web Cameras – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CFG-04.11_A01 assets are configured to prohibit the use of endpoint-based microphones and/or web cameras in secure areas or where sensitive and/or regulated information is discussed. Assessment rigor: 1 Origin: SCF Created
CFG-04.12 Multi-Function Devices (MFD) – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CFG-04.12_A01 Multi-Function Devices (MFD) are securely configured according to industry-recognized secure practices for the type of device. Defined parameters: at a minimum, a vendor-published hardening guide or an established configuration benchmark such as the Center for Internet Security (CIS) Benchmarks Assessment rigor: 1 Origin: SCF Created
CFG-04.13 Radio Frequency Identification (RFID) Security – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CFG-04.13_A01 secure baseline configurations exist for Radio Frequency Identification (RFID) devices to protect the confidentiality and integrity of data being stored, processed and/or transmitted. Defined parameters: at a minimum, the manufacturer's published hardening guidance for the device type Assessment rigor: 1 Origin: SCF Created CFG-04.13_A02 Radio Frequency Identification (RFID) devices are secured according to defined secure baseline configurations. Assessment rigor: 1 Origin: SCF Created
CFG-04.14 Contactless Access Control Systems – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CFG-04.14_A01 secure baseline configurations exist for contactless access control systems to protect the confidentiality and integrity of data being stored, processed and/or transmitted. Defined parameters: at a minimum, the manufacturer's published hardening guidance for the device type Assessment rigor: 1 Origin: SCF Created CFG-04.14_A02 contactless access control systems are secured according to defined secure baseline configurations. Assessment rigor: 1 Origin: SCF Created
CFG-04.15 Thin Nodes – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CFG-04.15_A01 system components to be employed with minimal functionality and information storage are defined. Assessment rigor: 1 Origin: 53A_R5_SC-25_ODP CFG-04.15_A02 minimal functionality for system components is employed. Assessment rigor: 1 Origin: 53A_R5_SC-25[01] CFG-04.15_A03 minimal information storage on system components is allocated. Assessment rigor: 1 Origin: 53A_R5_SC-25[02] CFG-04.15_A04 physical isolation techniques are defined. Assessment rigor: 3 Origin: 172A_3.13.4e_ODP[1] 172A_3.13.4e_ODP[2] CFG-04.15_A05 logical isolation techniques are defined. Assessment rigor: 3 Origin: 172A_3.13.4e_ODP[1] 172A_3.13.4e_ODP[3] CFG-04.15_A06 physical isolation techniques and/or logical isolation techniques are employed in organizational systems and system components. Assessment rigor: 3 Origin: 172A_3.13.4e[a]
CFG-04.16 Video Teleconference (VTC) Security – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CFG-04.16_A01 Video Teleconference (VTC) capabilities are secured in designated conference rooms to prevent potential eavesdropping. Assessment rigor: 1 Origin: SCF Created CFG-04.16_A02 personnel are trained to use Video Teleconference (VTC) capabilities on endpoint devices outside of conference rooms in a secure manner that prevents eavesdropping. Defined parameters: at least annually Assessment rigor: 1 Origin: SCF Created
CFG-04.17 Voice Over Internet Protocol (VoIP) Security – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CFG-04.17_A01 Internet Protocol Telephony (IPT) is implemented to logically or physically separate Voice Over Internet Protocol (VoIP) traffic from data networks. Assessment rigor: 1 Origin: SCF Created
CFG-04.18 Disable Wireless Networking – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CFG-04.18_A01 when not intended for use, wireless networking capabilities embedded within system components are disabled prior to issuance and deployment. Assessment rigor: 1 Origin: 53A_R5_AC-18(03)
CFG-05 Configure Technology Assets, Applications and/or Services (TAAS) for High-Risk Areas – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CFG-05_A01 security requirements to be applied to the system or system components when individuals return from travel are defined. Assessment rigor: 1 Origin: 53A_R5_CM-02(07)_ODP[01] 171A_R3_A.03.04.12.ODP[02] CFG-05_A02 organization-defined systems or system components with organization-defined configurations are issued to individuals traveling to locations that the organization deems to be of significant risk. Assessment rigor: 1 Origin: 53A_R5_CM-02(07)(a) 53A_R5_CM-02(07)_ODP[03] CFG-05_A03 organization-defined controls are applied to the systems or system components when the individuals return from travel. Assessment rigor: 3 Origin: 53A_R5_CM-02(07)(b) CFG-05_A04 configurations for systems or system components to be issued to individuals traveling to high-risk locations are defined. Assessment rigor: 2 Origin: 53A_R5_CM-02(07)_ODP[02] 172A_3.14.3e_ODP[1] 172A_3.14.3e[a] 172A_3.14.3e[b] 171A_R3_A.03.04.12.ODP[01]
CFG-05.1 Physically Disable or Remove Capabilities – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CFG-05.1_A01 connection ports or input/output devices to be disabled or removed are defined. Assessment rigor: 1 Origin: 53A_R5_SC-41_ODP[01] 53A_R5_SC-41_ODP[02] CFG-05.1_A02 technology assets at greater risk of device tampering from which connection ports or input/output devices are to be disabled or removed are defined. Assessment rigor: 1 Origin: 53A_R5_SC-41_ODP[03] CFG-05.1_A03 prohibited connection ports or input/output devices are physically disabled or removed from technology assets at greater risk of device tampering. Assessment rigor: 1 Origin: 53A_R5_SC-41
CFG-06 Approved Configuration Deviations – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CFG-06_A01 assessed component configurations are included in the system component inventory. Assessment rigor: 1 Origin: 53A_R5_CM-08(06)[01] CFG-06_A02 approved deviations to secure baseline configurations are documented in the system component inventory. Assessment rigor: 3 Origin: 53A_R5_CM-08(06)[02] CFG-06_A03 configuration settings that reflect the most restrictive mode consistent with operational requirements are established and documented for components employed within the system using common secure configurations. Assessment rigor: 1 Origin: 53A_R5_CM-06a. CFG-06_A04 changes to the configuration settings are controlled in accordance with organizational policies and procedures. Assessment rigor: 1 Origin: 53A_R5_CM-06d.[02] 53A_R5_CM-06b. CFG-06_A05 any deviations from established configuration settings are identified and documented. Assessment rigor: 1 Origin: 53A_R5_CM-06c.[01] 171A_R3_A.03.04.02.b[01] CFG-06_A06 any deviations from established configuration settings are approved. Assessment rigor: 1 Origin: 53A_R5_CM-06c.[02] 171A_R3_A.03.04.02.b[02] CFG-06_A07 common secure configurations to establish and document configuration settings for components employed within the system are defined. Defined parameters: DoD Security Technical Implementation Guides (STIGs); Center for Internet Security (CIS) Level 2 guidelines where STIGs are not available; custom baselines where CIS guidelines are not available Assessment rigor: 2 Origin: 53A_R5_CM-06_ODP[01] CFG-06_A08 system components for which approval of deviations is needed are defined. Assessment rigor: 3 Origin: 53A_R5_CM-06_ODP[02] CFG-06_A09 operational requirements necessitating approval of deviations are defined. Assessment rigor: 3 Origin: 53A_R5_CM-06_ODP[03] CFG-06_A10 changes to the configuration settings are monitored in accordance with organizational policies and procedures. Assessment rigor: 3 Origin: 53A_R5_CM-06d.[01] CFG-06_A11 deviations to secure baseline configurations are assessed prior to being approved or denied. Assessment rigor: 1 Origin: SCF Created CFG-06_A12 the approval or denial decision for each deviation to secure baseline configurations is recorded. Assessment rigor: 2 Origin: SCF Created
CFG-07 Baseline Configuration Reviews & Updates – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CFG-07_A01 the circumstances requiring secure baseline configuration review / update are defined. Assessment rigor: 1 Origin: 53A_R5_CM-02_ODP[02] CFG-07_A02 secure baseline configurations are reviewed / updated when required due to organization-defined circumstances. Defined parameters: at least annually and when a significant change occurs Assessment rigor: 2 Origin: 53A_R5_CM-02b.02 CFG-07_A03 the frequency of baseline configuration review / update is defined. Defined parameters: at least annually Assessment rigor: 2 Origin: 171A_R3_A.03.04.01.ODP[01] 53A_R5_CM-02_ODP[01] CFG-07_A04 secure baseline configurations are reviewed at least annually. Defined parameters: at least annually and when a significant change occurs Assessment rigor: 1 Origin: 53A_R5_CM-02b.01 CFG-07_A05 secure baseline configurations are updated when required as a result of the review. Defined parameters: when a significant change occurs Assessment rigor: 2 Origin: SCF Created CFG-07_A06 the baseline configuration of the system is reviewed when system components are installed or modified. Assessment rigor: 2 Origin: 171A_R3_A.03.04.01.b[03] 53A_R5_CM-02b.03 CFG-07_A07 the baseline configuration of the system is updated when system components are installed or modified. Assessment rigor: 2 Origin: 171A_R3_A.03.04.01.b[04] 53A_R5_CM-02b.03 CFG-07_A08 the system is reviewed <A.03.04.06.ODP[06]: frequency> to identify unnecessary or nonsecure functions, ports, protocols, connections, and services. Defined parameters: at least every 12 months, when any system functions, ports, protocols, or services changes are made, and after any significant incidents or significant changes to risks Assessment rigor: NIST 800-171 Origin: 171A_R3_A.03.04.06.c CFG-07_A09 the baseline configuration of the system is reviewed <A.03.04.01.ODP[01]: frequency>. Defined parameters: at least every 12 months and after any significant incidents or significant changes occur Assessment rigor: NIST 800-171 Origin: 171A_R3_A.03.04.01.b[01] CFG-07_A10 the baseline configuration of the system is updated <A.03.04.01.ODP[01]: frequency>. Defined parameters: at least every 12 months and after any significant incidents or significant changes occur Assessment rigor: NIST 800-171 Origin: 171A_R3_A.03.04.01.b[02]
CFG-07.1 Automated Baseline Configuration Management & Verification – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CFG-07.1_A01 system components for which to manage, apply and verify configuration settings are defined. Assessment rigor: 1 Origin: 53A_R5_CM-06(01)_ODP[01] 53A_R5_CM-06(01)_ODP[03] 53A_R5_CM-06(01)_ODP[04] CFG-07.1_A02 automated discovery and management tools are employed to maintain an up-to-date, complete, accurate and readily available inventory of system components. Assessment rigor: 1 Origin: 172A_3.4.3e[c] 53A_R5_CM-02(02)[03] 53A_R5_CM-02(02)[04] 53A_R5_CM-06(01)[01] 53A_R5_CM-06(01)[02] 53A_R5_CM-06(01)[03] CFG-07.1_A03 automated discovery and management tools for the inventory of system components are identified. Assessment rigor: 2 Origin: 172A_3.4.3e[a] 53A_R5_CM-02(02)_ODP 53A_R5_CM-06(01)_ODP[02] CFG-07.1_A04 an up-to-date, complete, accurate and readily available inventory of system components exists. Assessment rigor: 2 Origin: 172A_3.4.3e[b] 53A_R5_CM-02(02)[01] 53A_R5_CM-02(02)[02] CFG-07.1_A05 activities associated with configuration-controlled changes to the system are monitored. Assessment rigor: 2 Origin: 171A_R3_A.03.04.03.d[01] CFG-07.1_A06 activities associated with configuration-controlled changes to the system are reviewed. Assessment rigor: 2 Origin: 171A_R3_A.03.04.03.d[02]
CFG-08 Periodic Configuration Reviews – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CFG-08_A01 the frequency at which to review the system to identify unnecessary or nonsecure functions, ports, protocols, connections, or services is defined. Defined parameters: at least quarterly or when there is a change Assessment rigor: 1 Origin: 53A_R5_CM-07(01)(a) 53A_R5_CM-07(01)_ODP[01] 171A_R3_A.03.04.06.ODP[06] CFG-08_A02 organization-defined functions, ports, protocols, software and services deemed to be unnecessary and/or non-secure are disabled or removed. Assessment rigor: 1 Origin: 53A_R5_CM-07(01)(b)[01] 53A_R5_CM-07(01)(b)[02] 53A_R5_CM-07(01)(b)[03] 53A_R5_CM-07(01)(b)[04] 53A_R5_CM-07(01)(b)[05] CFG-08_A03 essential programs are defined. Assessment rigor: 2 Origin: 171A_3.4.7[a] CFG-08_A04 essential functions are defined. Assessment rigor: 2 Origin: 171A_3.4.7[d] CFG-08_A05 essential ports are defined. Assessment rigor: 2 Origin: 171A_3.4.7[g] CFG-08_A06 essential protocols are defined. Assessment rigor: 2 Origin: 171A_3.4.7[j] CFG-08_A07 essential services are defined. Assessment rigor: 2 Origin: 171A_3.4.7[m] CFG-08_A08 the use of nonessential programs is defined. Assessment rigor: 2 Origin: 171A_3.4.7[b] CFG-08_A09 the use of nonessential programs is restricted, disabled or prevented as defined. Assessment rigor: 2 Origin: 171A_3.4.7[c] CFG-08_A10 the use of nonessential functions is defined. Assessment rigor: 2 Origin: 171A_3.4.7[e] CFG-08_A11 the use of nonessential functions is restricted, disabled or prevented as defined. Assessment rigor: 2 Origin: 171A_3.4.7[f] CFG-08_A12 the use of nonessential ports is defined. Assessment rigor: 2 Origin: 171A_3.4.7[h] CFG-08_A13 the use of nonessential protocols is defined. Assessment rigor: 2 Origin: 171A_3.4.7[k] CFG-08_A14 the use of nonessential ports is restricted, disabled or prevented as defined. Assessment rigor: 2 Origin: 171A_3.4.7[i] CFG-08_A15 the use of nonessential protocols is restricted, disabled or prevented as defined. Assessment rigor: 2 Origin: 171A_3.4.7[l] CFG-08_A16 the use of nonessential services is defined. Assessment rigor: 2 Origin: 171A_3.4.7[n] CFG-08_A17 the use of nonessential services is restricted, disabled or prevented as defined. Assessment rigor: 2 Origin: 171A_3.4.7[o] CFG-08_A18 functions to be disabled or removed when deemed unnecessary or non-secure are defined. Assessment rigor: 3 Origin: 53A_R5_CM-07(01)_ODP[02] CFG-08_A19 ports to be disabled or removed when deemed unnecessary or non-secure are defined. Assessment rigor: 3 Origin: 53A_R5_CM-07(01)_ODP[03] CFG-08_A20 protocols to be disabled or removed when deemed unnecessary or non-secure are defined. Assessment rigor: 3 Origin: 53A_R5_CM-07(01)_ODP[04] CFG-08_A21 software to be disabled or removed when deemed unnecessary or non-secure is defined. Assessment rigor: 3 Origin: 53A_R5_CM-07(01)_ODP[05] CFG-08_A22 services to be disabled or removed when deemed unnecessary or non-secure are defined. Assessment rigor: 3 Origin: 53A_R5_CM-07(01)_ODP[06] CFG-08_A23 Technology Assets, Applications and/or Services (TAAS) configurations are reviewed at the organization-defined frequency to identify unnecessary and/or non-secure functions, ports, protocols and services. Defined parameters: at least quarterly or when there is a change Assessment rigor: 1 Origin: SCF Created
CFG-08.1 Respond To Unauthorized Changes – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CFG-08.1_A01 actions to be taken upon an unauthorized change are defined. Assessment rigor: 1 Origin: 53A_R5_CM-06(02)_ODP[01] CFG-08.1_A02 organization-defined actions are taken in response to unauthorized changes to secure baseline configurations. Assessment rigor: 2 Origin: 53A_R5_CM-06(02) CFG-08.1_A03 secure baseline configurations requiring action upon an unauthorized change are defined. Assessment rigor: 3 Origin: 53A_R5_CM-06(02)_ODP[02] CFG-08.1_A04 unauthorized changes to secure baseline configurations are handled as security incidents through the incident response process. Assessment rigor: 1 Origin: SCF Created
CFG-08.2 Integrity Assurance & Enforcement (IAE) – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CFG-08.2_A01 the circumstances under which changes are to be prevented or restricted are defined. Assessment rigor: 1 Origin: 53A_R5_CM-03(08)_ODP CFG-08.2_A02 changes to the configuration of the system are prevented or restricted under organization-defined circumstances. Assessment rigor: 1 Origin: 53A_R5_CM-03(08) CFG-08.2_A03 automated mechanisms used to remediate unauthorized deviations from approved secure baseline configurations are defined. Assessment rigor: 3 Origin: 53A_R5_CM-11(03)_ODP[01] CFG-08.2_A04 automated mechanisms used to identify unauthorized deviations from approved secure baseline configurations are defined. Assessment rigor: 3 Origin: 53A_R5_CM-11(03)_ODP[02] CFG-08.2_A05 compliance with software installation policies is enforced using automated mechanisms. Assessment rigor: 3 Origin: 53A_R5_CM-11(03)[01] CFG-08.2_A06 compliance with software installation policies is monitored using automated mechanisms. Assessment rigor: 3 Origin: 53A_R5_CM-11(03)[02] CFG-08.2_A07 unauthorized deviations from an approved secure baseline configuration are identified by automated mechanisms. Defined parameters: at least weekly, or continuously where the monitoring technology supports it Assessment rigor: 1 Origin: SCF Created CFG-08.2_A08 automated resiliency actions are implemented to remediate identified unauthorized deviations from the approved secure baseline configuration. Assessment rigor: 2 Origin: SCF Created
CFG-09 Retention Of Previous Configurations – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CFG-09_A01 the number of previous secure baseline configuration versions to be retained is defined. Assessment rigor: 1 Origin: 53A_R5_CM-02(03)_ODP CFG-09_A02 the organization-defined number of previous secure baseline configuration versions is retained to support roll back. Assessment rigor: 1 Origin: 53A_R5_CM-02(03)
CFG-10 Network Device Configuration File Synchronization – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CFG-10_A01 network devices are configured to synchronize startup and running configuration files. Assessment rigor: 1 Origin: SCF Created
CFG-11 Software Usage Restrictions – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CFG-11_A01 software and associated documentation are used in accordance with contract agreements and copyright laws. Assessment rigor: 1 Origin: 53A_R5_CM-10a. CFG-11_A02 the use of software and associated documentation protected by quantity licenses is tracked to control copying and distribution. Assessment rigor: 3 Origin: 53A_R5_CM-10b. CFG-11_A03 the use of peer-to-peer file sharing technology is controlled and documented to ensure that peer-to-peer file sharing is not used for the unauthorized distribution, display, performance or reproduction of copyrighted work. Assessment rigor: 3 Origin: 53A_R5_CM-10c.
CFG-12 Restrict Roles Permitted To Install Software – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CFG-12_A01 policies governing the installation of software by users are defined. Assessment rigor: 2 Origin: 171A_3.4.9[b] 53A_R5_CM-11_ODP[01] 53A_R5_CM-11a. CFG-12_A02 methods used to enforce software installation policies are defined. Assessment rigor: 1 Origin: 53A_R5_CM-11_ODP[02] CFG-12_A03 software installation policies are enforced through organization-defined methods. Assessment rigor: 1 Origin: 53A_R5_CM-11b. CFG-12_A04 installation of software by users is monitored. Defined parameters: Continuously Assessment rigor: 2 Origin: 171A_3.4.9[c] 53A_R5_CM-11_ODP[03] 53A_R5_CM-11c. CFG-12_A05 configuration settings prevent the ability of non-privileged users to install unauthorized software. Assessment rigor: 2 Origin: 171A_3.4.9[a] CFG-12_A06 the installation of software is prevented by automated mechanisms unless the action is performed by a privileged user or service. Assessment rigor: 1 Origin: 53A_R5_CM-11(02)
CFG-12.1 Configuration Management Role Assignment – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CFG-12.1_A01 the responsibility for developing the configuration management process is assigned to organizational personnel who are not directly involved in system development. Assessment rigor: 1 Origin: 53A_R5_CM-09(01)
CFG-13 Open Source Software – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CFG-13_A01 restrictions on the use of open-source software are defined. Assessment rigor: 1 Origin: 53A_R5_CM-10(01)_ODP CFG-13_A02 organization-defined restrictions are established for the use of open-source software. Assessment rigor: 1 Origin: 53A_R5_CM-10(01)
CFG-14 Prevent Unauthorized Software Execution – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CFG-14_A01 policies, rules of behavior, and/or access agreements regarding unauthorized software program usage and restrictions are defined. Assessment rigor: 1 Origin: 53A_R5_CM-07(02)_ODP[01] 53A_R5_CM-07(02)_ODP[02] CFG-14_A02 the execution of unauthorized software programs is prevented by automated mechanisms in accordance with organization-defined criteria (e.g., policies, rules of behavior, and/or access agreements). Assessment rigor: 1 Origin: 53A_R5_CM-07(02) 53A_R5_CM-07(02)_ODP[01]
CFG-14.1 Explicitly Allow / Deny Applications – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CFG-14.1_A01 a policy and/or process specifying whether whitelisting or blacklisting is to be implemented is specified. Defined parameters: allowlisting, implemented as a deny-all, permit-by-exception policy Assessment rigor: 2 Origin: 171A_3.4.8[a] CFG-14.1_A02 the software allowed to execute under whitelisting or denied use under blacklisting is specified. Assessment rigor: 1 Origin: 171A_3.4.8[b] CFG-14.1_A03 whitelisting to allow the execution of authorized software or blacklisting to prevent the use of unauthorized software is implemented as specified. Assessment rigor: 1 Origin: 171A_3.4.8[c] CFG-14.1_A04 registration requirements for functions, ports, protocols and services are defined. Assessment rigor: 2 Origin: 53A_R5_CM-07(03)_ODP CFG-14.1_A05 an allow-all, deny-by-exception policy is employed to prohibit the execution of unauthorized software programs on the system. Assessment rigor: 2 Origin: 53A_R5_CM-07(04)(b) CFG-14.1_A06 the list of unauthorized software programs is reviewed / updated organization-defined frequency. Defined parameters: at least quarterly or when there is a change Assessment rigor: 2 Origin: 53A_R5_CM-07(04)(c) CFG-14.1_A07 organization-defined registration requirements are complied with. Assessment rigor: 3 Origin: 53A_R5_CM-07(03) CFG-14.1_A08 software programs not authorized to execute on the system are defined. Assessment rigor: 3 Origin: 53A_R5_CM-07(04)_ODP[01] CFG-14.1_A09 frequency at which to review / update the list of unauthorized software programs is defined. Defined parameters: at least quarterly or when there is a change Assessment rigor: 3 Origin: 53A_R5_CM-07(04)_ODP[02] CFG-14.1_A10 organization-defined software programs are identified. Assessment rigor: 3 Origin: 53A_R5_CM-07(04)(a) 53A_R5_CM-07(05)(a) CFG-14.1_A11 software programs authorized to execute on the system are identified. Assessment rigor: 2 Origin: 53A_R5_CM-07(05)_ODP[01] 171A_R3_A.03.04.08.a CFG-14.1_A12 the frequency at which to review and update the list of authorized software programs is defined. Defined parameters: at least quarterly or when there is a change Assessment rigor: 2 Origin: 53A_R5_CM-07(05)_ODP[02] 171A_R3_A.03.04.08.ODP[01] CFG-14.1_A13 a deny-all, allow-by-exception policy for the execution of authorized software programs on the system is implemented. Assessment rigor: 2 Origin: 53A_R5_CM-07(05)(b) 171A_R3_A.03.04.08.b CFG-14.1_A14 the list of authorized software programs is reviewed / updated organization-defined frequency. Defined parameters: at least quarterly or when there is a change Assessment rigor: 3 Origin: 53A_R5_CM-07(05)(c) CFG-14.1_A15 the automatic execution of mobile code in organization-defined software applications is prevented. Assessment rigor: 3 Origin: 53A_R5_SC-18(04)[01] CFG-14.1_A16 organization-defined actions are enforced prior to executing mobile code. Assessment rigor: 3 Origin: 53A_R5_SC-18(04)[02] CFG-14.1_A17 the use of mobile code is controlled. Assessment rigor: 2 Origin: 171A_R3_A.03.13.13.b[03]
CFG-15 Unsupported Internet Browsers & Email Clients – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CFG-15_A01 security configuration settings for authorized Internet browsers are established. Assessment rigor: 1 Origin: SCF Created CFG-15_A02 security configuration settings for authorized email clients are established. Assessment rigor: 1 Origin: SCF Created CFG-15_A03 users are prevented from installing unauthorized Internet browsers and/or email clients through technical and/or administrative mechanisms. Assessment rigor: 1 Origin: SCF Created CFG-15_A04 the detection of unauthorized Internet browsers and/or email clients is responded to as a security incident, per established incident response procedures. Assessment rigor: 1 Origin: SCF Created
CFG-16 Zero-Touch Provisioning (ZTP) – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CFG-16_A01 automated mechanisms used to perform Zero-Touch Provisioning (ZTP) are defined. Assessment rigor: 1 Origin: SCF Created CFG-16_A02 an automated mechanism performs Zero-Touch Provisioning (ZTP) to deploy secure baseline configurations upon devices being added to a network. Assessment rigor: 1 Origin: SCF Created
CFG-17 Production Software Repository – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CFG-17_A01 an authoritative repository for production software is established and maintained. Assessment rigor: 1 Origin: SCF Created
CFG-17.1 Third-Party Libraries – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CFG-17.1_A01 the use and import of third-party libraries and/or software components are restricted to trustworthy sources. Assessment rigor: 1 Origin: SCF Created
CFG-17.2 Software Repository Protections – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CFG-17.2_A01 software repositories are protected from importing untrusted and/or malicious software artifacts. Assessment rigor: 1 Origin: SCF Created CFG-17.2_A02 software artifacts are scanned for malicious content. Defined parameters: prior to import into the repository Assessment rigor: 1 Origin: SCF Created CFG-17.2_A03 the digital signature or secure hash provided over a secure channel for each software artifact is verified. Defined parameters: prior to import into the repository Assessment rigor: 1 Origin: SCF Created CFG-17.2_A04 software artifacts are scanned to identify plain text or encoded secrets and keys. Defined parameters: prior to import into the repository Assessment rigor: 1 Origin: SCF Created
CFG-17.3 Software Development Repository – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CFG-17.3_A01 an authoritative repository for software development activities is maintained separately from production software. Assessment rigor: 1 Origin: SCF Created
CFG-18 Embedded Sensor Capability – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CFG-18_A01 environmental sensing capabilities in devices are defined. Assessment rigor: 1 Origin: 53A_R5_SC-42_ODP[01] 53A_R5_SC-42_ODP[02] CFG-18_A02 facilities, areas or systems where the use of devices possessing environmental sensing capabilities is prohibited are defined. Assessment rigor: 1 Origin: 53A_R5_SC-42_ODP[03] CFG-18_A03 exceptions where remote activation of sensors is allowed are defined. Assessment rigor: 1 Origin: 53A_R5_SC-42_ODP[04] CFG-18_A04 group of users to whom an explicit indication of sensor use is to be provided is defined. Assessment rigor: 3 Origin: 53A_R5_SC-42_ODP[05] CFG-18_A05 organization-defined parameters are prohibited. Assessment rigor: 3 Origin: 53A_R5_SC-42a. CFG-18_A06 an explicit indication of sensor use is provided to a group of users. Assessment rigor: 3 Origin: 53A_R5_SC-42b.
CFG-18.1 Embedded Sensor Data Use Restrictions – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CFG-18.1_A01 measures to restrict the use of data collected by embedded sensors to authorized purposes are defined. Assessment rigor: 1 Origin: 53A_R5_SC-42(02)_ODP CFG-18.1_A02 data collected by embedded sensors is restricted to authorized purposes through organization-defined measures. Assessment rigor: 1 Origin: 53A_R5_SC-42(02) CFG-18.1_A03 the authorized purposes for which data collected by embedded sensors may be used are defined. Assessment rigor: 3 Origin: SCF Created
CFG-18.2 Notice of Embedded Sensor Data Collection – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CFG-18.2_A01 measures to notify individuals of embedded sensor data collection are defined. Assessment rigor: 1 Origin: 53A_R5_SC-42(04)_ODP[01] CFG-18.2_A02 embedded sensors for which individuals are to be notified of data collection are defined. Assessment rigor: 1 Origin: 53A_R5_SC-42(04)_ODP[02] CFG-18.2_A03 individuals are notified of embedded sensor data collection through organization-defined measures. Assessment rigor: 1 Origin: 53A_R5_SC-42(04)
CFG-18.3 Embedded Sensor Data Collection Minimization – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CFG-18.3_A01 processes that implement the privacy principle of minimization are defined. Assessment rigor: 1 Origin: 53A_R5_SA-08(33)_ODP CFG-18.3_A02 the privacy principle of minimization is implemented using organization-defined processes. Assessment rigor: 1 Origin: 53A_R5_SA-08(33) CFG-18.3_A03 the embedded sensors that are configured to minimize the collection of unneeded information about individuals are defined. Assessment rigor: 1 Origin: 53A_R5_SC-42(05)_ODP CFG-18.3_A04 embedded sensors configured to minimize the collection of information about individuals that is not needed are employed. Assessment rigor: 1 Origin: 53A_R5_SC-42(05) CFG-18.3_A05 the frequency for reviewing / updating policies that address the use of Personal Data (PD) for internal testing, training and research is defined. Defined parameters: at least annually Assessment rigor: 3 Origin: 53A_R5_PM-25_ODP[01] 53A_R5_PM-25_ODP[02] 53A_R5_PM-25_ODP[03] 53A_R5_PM-25_ODP[04] CFG-18.3_A06 policies that address the use of Personal Data (PD) for internal testing, training and research are developed and documented. Assessment rigor: 3 Origin: 53A_R5_PM-25a.[01] 53A_R5_PM-25a.[02] 53A_R5_PM-25a.[03] CFG-18.3_A07 procedures that address the use of Personal Data (PD) for internal testing, training and research are developed and documented. Assessment rigor: 3 Origin: 53A_R5_PM-25a.[04] 53A_R5_PM-25a.[05] 53A_R5_PM-25a.[06] CFG-18.3_A08 policies that address the use of Personal Data (PD) for internal testing, training and research are implemented. Assessment rigor: 3 Origin: 53A_R5_PM-25a.[07] 53A_R5_PM-25a.[08] 53A_R5_PM-25a.[09] CFG-18.3_A09 procedures that address the use of Personal Data (PD) for internal testing, training and research are implemented. Assessment rigor: 3 Origin: 53A_R5_PM-25a.[10] 53A_R5_PM-25a.[11] 53A_R5_PM-25a.[12] CFG-18.3_A10 the amount of Personal Data (PD) used for internal testing, training and research purposes is limited or minimized. Assessment rigor: 3 Origin: 53A_R5_PM-25b.[01] 53A_R5_PM-25b.[02] 53A_R5_PM-25b.[03] CFG-18.3_A11 the required use of Personal Data (PD) for internal testing, training and research is authorized. Assessment rigor: 3 Origin: 53A_R5_PM-25c.[01] 53A_R5_PM-25c.[02] 53A_R5_PM-25c.[03] CFG-18.3_A12 policies are reviewed / updated frequently. Assessment rigor: 3 Origin: 53A_R5_PM-25d.[01] 53A_R5_PM-25d.[02] CFG-18.3_A13 procedures are reviewed / updated frequently. Assessment rigor: 3 Origin: 53A_R5_PM-25d.[03] 53A_R5_PM-25d.[04]
CFG-18.4 Embedded Sensor Configuration Verification – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CFG-18.4_A01 embedded sensors whose configurations are to be verified are defined. Assessment rigor: 1 Origin: 53A_R5_SC-42(01)_ODP CFG-18.4_A02 embedded sensor configurations are verified so that the delivery of collected data is restricted to authorized individuals or roles. Assessment rigor: 1 Origin: 53A_R5_SC-42(01) CFG-18.4_A03 embedded sensor configurations are verified so that the delivery of collected data is restricted to authorized repositories. Assessment rigor: 1 Origin: SCF Created CFG-18.4_A04 the authorized repositories, individuals and/or roles to which data collected by embedded sensors may be delivered are defined. Assessment rigor: 3 Origin: SCF Created
CFG-19 Refresh from Trusted Sources – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CFG-19_A01 a technology refresh schedule is planned for the system throughout the system development life cycle. Assessment rigor: 1 Origin: 53A_R5_SA-03(03)[01] CFG-19_A02 a technology refresh schedule is implemented for the system throughout the system development life cycle. Assessment rigor: 1 Origin: 53A_R5_SA-03(03)[02] CFG-19_A03 trusted sources to obtain software and data for system component and service refreshes are defined. Assessment rigor: 1 Origin: 53A_R5_SI-14(01)_ODP CFG-19_A04 the software and data employed during system component and service refreshes are obtained from organization-defined trusted sources. Assessment rigor: 1 Origin: 53A_R5_SI-14(01) CFG-19_A05 approved systems and system components are identified. Assessment rigor: 3 Origin: 172A_3.4.1e[a] CFG-19_A06 implemented system components are identified. Assessment rigor: 3 Origin: 172A_3.4.1e[b] CFG-19_A07 an authoritative source and repository are established to provide a trusted source and accountability for approved and implemented system components. Assessment rigor: 3 Origin: 172A_3.4.1e[c] CFG-19_A08 an authoritative source and repository are maintained to provide a trusted source and accountability for approved and implemented system components. Assessment rigor: 3 Origin: 172A_3.4.1e[d] CFG-19_A09 systems and system components to refresh from a known, trusted state are defined. Assessment rigor: 3 Origin: 172A_3.14.4e_ODP[1] CFG-19_A10 the frequency to refresh systems and systems components is defined. Assessment rigor: 3 Origin: 172A_3.14.4e_ODP[2] CFG-19_A11 a known, trusted state is identified for systems and system components. Assessment rigor: 3 Origin: 172A_3.14.4e[a] CFG-19_A12 systems and system components are refreshed from a known, trusted state per an organization-defined frequency. Assessment rigor: 3 Origin: 172A_3.14.4e[b]
CFG-20 Hypervisor Access – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CFG-20_A01 access to hypervisor management functions or administrative consoles for systems hosting virtualized systems is restricted to authorized administrators. Assessment rigor: 1 Origin: SCF Created
CFG-21 Restrict Access To Security Functions – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CFG-21_A01 access to security functions is restricted to authorized individuals, applying least privilege for necessary job functions. Assessment rigor: 1 Origin: SCF Created
CFG-22 Host-Based Security Function Isolation – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CFG-22_A01 host-based boundary protection mechanisms to be implemented are defined. Defined parameters: Host Intrusion Prevention System(hIPS), Host Intrusion Detection System(hIDS), or minimally a host-based firewall Assessment rigor: 1 Origin: 53A_R5_SC-07(12)_ODP[01] CFG-22_A02 system components where host-based boundary protection mechanisms are to be implemented are defined. Assessment rigor: 1 Origin: 53A_R5_SC-07(12)_ODP[02] CFG-22_A03 host-based boundary protection mechanisms are implemented at system components. Assessment rigor: 1 Origin: 53A_R5_SC-07(12)
CFG-23 Control Assurance Automation (CAA) Change Control – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CFG-23_A01 Control Assurance Automation (CAA) collection code, queries and transformation logic are maintained under version control. Assessment rigor: 1 Origin: SCF Created CFG-23_A02 changes to Control Assurance Automation (CAA) collection code, queries and transformation logic are peer reviewed by an individual other than the author prior to deployment. Assessment rigor: 2 Origin: SCF Created CFG-23_A03 changes to Control Assurance Automation (CAA) collection code, queries and transformation logic are tested prior to deployment to confirm they produce the intended results. Assessment rigor: 2 Origin: SCF Created CFG-23_A04 changes to Control Assurance Automation (CAA) collection code, queries and transformation logic are authorized through change management, with approval recorded prior to deployment. Assessment rigor: 2 Origin: SCF Created CFG-23_A05 the level of review, testing and change management rigor applied to Control Assurance Automation (CAA) logic is defined commensurate with the sensitivity of the Technology Assets, Applications, Services and/or Data (TAASD) accessed. Assessment rigor: 3 Origin: SCF Created
CFG-24 Control Assurance Automation (CAA) Unauthorized Change Detection – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CFG-24_A01 changes to Control Assurance Automation (CAA) collection or scoring logic that could alter reported control status are detected (e.g., through file integrity monitoring, version control hooks or configuration drift detection). Assessment rigor: 1 Origin: SCF Created CFG-24_A02 detected changes to Control Assurance Automation (CAA) collection or scoring logic are reconciled against authorized change records. Assessment rigor: 2 Origin: SCF Created CFG-24_A03 changes to Control Assurance Automation (CAA) collection or scoring logic that lack a corresponding authorized change record generate an alert to designated personnel. Assessment rigor: 2 Origin: SCF Created CFG-24_A04 the personnel or roles that receive alerts of unauthorized changes to Control Assurance Automation (CAA) logic are defined. Assessment rigor: 3 Origin: SCF Created CFG-24_A05 alerts of unauthorized changes to Control Assurance Automation (CAA) logic are investigated and resolved within a defined time period, including determining whether reported control status was affected. Assessment rigor: 3 Origin: SCF Created
CFG-25 Control Assurance Automation (CAA) Separation of Duties – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: CFG-25_A01 the individuals or roles responsible for operating each control evidenced by Control Assurance Automation (CAA) are identified and documented. Assessment rigor: 1 Origin: SCF Created CFG-25_A02 the individuals or roles authorized to modify Control Assurance Automation (CAA) collection, transformation or scoring logic are identified and documented. Assessment rigor: 1 Origin: SCF Created CFG-25_A03 access controls prevent an individual responsible for operating a control from modifying the Control Assurance Automation (CAA) collection, transformation or scoring logic used to evidence that control without independent approval (e.g., enforced peer review, protected branches or a separate deployment role). Assessment rigor: 1 Origin: SCF Created CFG-25_A04 separation of duties between control operation and Control Assurance Automation (CAA) logic modification is reviewed at a defined frequency and when personnel or role assignments change. Defined parameters: at least annually, and upon significant change Assessment rigor: 2 Origin: SCF Created CFG-25_A05 where separation of duties cannot be achieved, compensating controls (e.g., independent review of all Control Assurance Automation (CAA) logic changes) are documented and approved. Assessment rigor: 1 Origin: SCF Created
MON-01 Continuous Monitoring Policy – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: MON-01_A01 a formal, documented continuous monitoring policy is approved by executive management, or a formally delegated authority, and conveys executive management's intent for continuous monitoring. Assessment rigor: 1 Origin: SCF Created MON-01_A02 the continuous monitoring policy provides organizational direction and states the behaviors expected of personnel and other applicable parties with respect to continuous monitoring. Assessment rigor: 1 Origin: SCF Created MON-01_A03 the current version of the continuous monitoring policy is communicated to, and accessible by, the personnel and other applicable parties who are expected to comply with it. Assessment rigor: 1 Origin: SCF Created MON-01_A04 the continuous monitoring policy is reviewed at least annually. Defined parameters: at least annually Assessment rigor: 1 Origin: SCF Created MON-01_A05 the continuous monitoring policy is updated, as necessary, in response to changes in risks, threats, business practices and/or statutory, regulatory and contractual obligations that affect the organization. Assessment rigor: 1 Origin: SCF Created
MON-02 Continuous Monitoring – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: MON-02_A01 the continuous monitoring program is organization-wide. Assessment rigor: 1 Origin: 53A_R5_AU-01_ODP[03] MON-02_A02 monitoring objectives to detect attacks and indicators of potential attacks on the system are defined. Assessment rigor: 1 Origin: 53A_R5_SI-04_ODP[01] MON-02_A03 techniques and methods used to identify unauthorized use of the system are defined. Assessment rigor: 1 Origin: 53A_R5_SI-04_ODP[02] MON-02_A04 system monitoring information to be provided to personnel or roles is defined. Assessment rigor: 3 Origin: 53A_R5_SI-04_ODP[03] 53A_R5_SI-04g. MON-02_A05 personnel or roles to whom system monitoring information is to be provided is/are defined. Assessment rigor: 3 Origin: 53A_R5_SI-04_ODP[04] MON-02_A06 a frequency for providing system monitoring to personnel or roles is defined. Defined parameters: at least monthly Assessment rigor: 3 Origin: 53A_R5_SI-04_ODP[05] 53A_R5_SI-04_ODP[06] MON-02_A07 the level of system monitoring activity is adjusted when there is a change in risk to organizational operations and assets, individuals, other organizations or the Nation. Assessment rigor: 3 Origin: 53A_R5_SI-04e. MON-02_A08 a legal opinion regarding system monitoring activities is obtained. Assessment rigor: 3 Origin: 53A_R5_SI-04f. MON-02_A09 the system is monitored to detect attacks. Assessment rigor: 2 Origin: 171A_R3_A.03.14.06.a.01[01] MON-02_A10 the system is monitored to detect indicators of potential attacks. Assessment rigor: 2 Origin: 171A_R3_A.03.14.06.a.01[02] MON-02_A11 the system is monitored to detect unauthorized connections. Assessment rigor: 2 Origin: 171A_R3_A.03.14.06.a.02 MON-02_A12 event monitoring operations are conducted according to documented policies, standards, procedures and/or other organizational directives. Assessment rigor: 1 Origin: SCF Created MON-02_A13 resources (e.g., people, processes, technologies, data and/or facilities) required to support event monitoring operations are identified and provided. Assessment rigor: 1 Origin: SCF Created MON-02_A14 responsibility and authority for the performance of event monitoring-related activities are assigned to designated personnel. Assessment rigor: 1 Origin: SCF Created MON-02_A15 personnel performing event monitoring-related activities have the skills and knowledge needed to perform their assigned duties. Assessment rigor: 2 Origin: SCF Created
MON-03 Event Log & Security-Relevant Telemetry Monitoring – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: MON-03_A01 the frequency at which system audit records are reviewed and analyzed is defined. Defined parameters: at least weekly Assessment rigor: 1 Origin: 171A_R3_A.03.03.05.ODP[01] MON-03_A02 system audit records are reviewed and analyzed per an organization-defined frequency for indications and the potential impact of inappropriate or unusual activity. Defined parameters: at least weekly Assessment rigor: 1 Origin: 171A_3.3.3[a] 171A_3.3.3[b] MON-03_A03 response actions to system security alerts and advisories are identified. Assessment rigor: 1 Origin: 171A_3.14.3[a] MON-03_A04 system security alerts and advisories are monitored. Assessment rigor: 1 Origin: 171A_3.14.3[b] MON-03_A05 actions in response to system security alerts and advisories are taken. Assessment rigor: 1 Origin: 171A_3.14.3[c] MON-03_A06 the frequency of event types selected for logging are reviewed and updated. Defined parameters: at least weekly Assessment rigor: 2 Origin: 171A_R3_A.03.03.01.ODP[02] MON-03_A07 event types being logged are updated based on the review. Assessment rigor: 2 Origin: 171A_3.3.3[c] MON-03_A08 a process for determining when to review logged events is defined. Assessment rigor: 2 Origin: 171A_3.3.3[a] MON-03_A09 the event types selected for logging are reviewed <A.03.03.01.ODP[02]: frequency>. Defined parameters: at least every 12 months and after any significant incidents or significant changes to risks Assessment rigor: NIST 800-171 Origin: 171A_R3_A.03.03.01.b[01] MON-03_A10 system audit records are reviewed and analyzed <A.03.03.05.ODP[01]: frequency> for indications and the potential impact of inappropriate or unusual activity. Defined parameters: at least weekly Assessment rigor: NIST 800-171 Origin: 171A_R3_A.03.03.05.a MON-03_A11 security-relevant telemetry is reviewed per an organization-defined frequency for indications of inappropriate or unusual activity. Assessment rigor: 1 Origin: SCF Created MON-03_A12 incidents identified through event log and security-relevant telemetry review are escalated in accordance with established timelines and procedures. Assessment rigor: 2 Origin: SCF Created
MON-03.1 Centralized Management of Event Log & Security-Relevant Telemetry Content – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: MON-03.1_A01 the system components whose event log and security-relevant telemetry capture criteria are centrally managed are defined. Assessment rigor: 1 Origin: 53A_R5_PL-09_ODP MON-03.1_A02 the criteria to be captured in event logs and security-relevant telemetry generated by the defined system components are centrally managed and updated. Assessment rigor: 1 Origin: 53A_R5_PL-09
MON-03.2 Analyze and Prioritize Monitoring Requirements – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: MON-03.2_A01 the organization formally identifies its needs for monitoring. Assessment rigor: 1 Origin: SCF Created MON-03.2_A02 monitoring needs are prioritized by Technology Assets, Applications and/or Services (TAAS), based on (1) TAAS criticality and (2) the sensitivity of the data stored, transmitted and processed. Assessment rigor: 1 Origin: SCF Created
MON-03.3 Audit Level Adjustments – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: MON-03.3_A01 system audit records are reviewed and analyzed per an organization-defined frequency for indications of organization-defined inappropriate or unusual activity and the potential impact of the inappropriate or unusual activity. Defined parameters: at least weekly Assessment rigor: 1 Origin: 53A_R5_AU-06a. MON-03.3_A02 findings are reported to organization-defined personnel or roles. Defined parameters: at least weekly Assessment rigor: 1 Origin: 53A_R5_AU-06b. MON-03.3_A03 the level of audit record review, analysis and reporting within the system is adjusted when there is a change in risk based on law enforcement information, intelligence information or other credible sources of information. Assessment rigor: 1 Origin: 53A_R5_AU-06c. MON-03.3_A04 the frequency at which system audit records are reviewed and analyzed is defined. Defined parameters: at least weekly Assessment rigor: 3 Origin: 53A_R5_AU-06_ODP[01] MON-03.3_A05 inappropriate or unusual activity is defined. Assessment rigor: 3 Origin: 53A_R5_AU-06_ODP[02] MON-03.3_A06 personnel or roles to receive findings from reviews and analyses of system records is/are defined. Assessment rigor: 3 Origin: 53A_R5_AU-06_ODP[03]
MON-04 System Generated Event Logs & Security-Relevant Telemetry – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: MON-04_A01 audit records contain information that establishes what type of event occurred. Assessment rigor: 1 Origin: 171A_R3_A.03.03.02.a.01 MON-04_A02 audit records for the selected event types and audit record content are generated. Assessment rigor: 1 Origin: SCF Created MON-04_A03 personnel or roles to be alerted when indications of compromise or potential compromise occur is/are defined. Assessment rigor: 1 Origin: 53A_R5_SI-04(05)_ODP[01] MON-04_A04 compromise indicators are defined. Assessment rigor: 1 Origin: 53A_R5_SI-04(05)_ODP[02] MON-04_A05 personnel or roles are alerted when system-generated compromise indicators occur. Assessment rigor: 1 Origin: 53A_R5_SI-04(05) MON-04_A06 audit records for the selected event types and audit record content specified in 03.03.01 and 03.03.02 are generated. Assessment rigor: 2 Origin: 171A_R3_A.03.03.03.a MON-04_A07 event logs and security-relevant telemetry from physical, cybersecurity, data protection and supply chain activities are correlated to achieve integrated situational awareness. Assessment rigor: 1 Origin: SCF Created
MON-04.1 System-Wide / Time-Correlated Audit Trail – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: MON-04.1_A01 system components from which audit records are to be compiled into a system-wide (logical or physical) audit trail are defined. Defined parameters: all network, data storage, and computing devices Assessment rigor: 1 Origin: 53A_R5_AU-12(01)_ODP[01] MON-04.1_A02 level of tolerance for the relationship between timestamps of individual records in the audit trail is defined. Assessment rigor: 1 Origin: 53A_R5_AU-12(01)_ODP[02] MON-04.1_A03 audit records from organization-defined system components are compiled into a system-wide (logical or physical) audit trail that is time-correlated to within organization-defined level of tolerance. Assessment rigor: 1 Origin: 53A_R5_AU-12(01)
MON-05 Centralized Collection of Event Logs & Security-Relevant Telemetry – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: MON-05_A01 the frequency at which system audit records are reviewed and analyzed is defined. Defined parameters: at least weekly Assessment rigor: 1 Origin: 171A_R3_A.03.03.05.ODP[01] MON-05_A02 system audit records are reviewed and analyzed per an organization-defined frequency for indications and the potential impact of inappropriate or unusual activity. Defined parameters: at least weekly Assessment rigor: 1 Origin: SCF Created MON-05_A03 audit records across different repositories are analyzed to gain organization-wide situational awareness. Assessment rigor: 1 Origin: 171A_R3_A.03.03.05.c[01] MON-05_A04 automated mechanisms used for integrating audit record review, analysis and reporting processes are defined. Assessment rigor: 1 Origin: 53A_R5_AU-06(01)_ODP MON-05_A05 audit record review, analysis and reporting processes are integrated using organization-defined automated mechanisms. Assessment rigor: 1 Origin: 53A_R5_AU-06(01) MON-05_A06 the frequency or situation requiring logging for each specified event type is defined. Defined parameters: continually for each identified event type Assessment rigor: 3 Origin: 53A_R5_AU-06_ODP[01] 53A_R5_AU-02_ODP[03] MON-05_A07 the event logging function is coordinated with other organizational entities requiring audit-related information to guide and inform the selection criteria for events to be logged. Assessment rigor: 3 Origin: 53A_R5_AU-02b. MON-05_A08 the event types selected for logging are reviewed / updated organization-defined frequency. Defined parameters: annually and whenever there is a change in the threat environment Assessment rigor: 2 Origin: 53A_R5_AU-02e. MON-05_A09 a rationale is provided for why the event types selected for logging are deemed to be adequate to support after-the-fact investigations of incidents. Assessment rigor: 3 Origin: 53A_R5_AU-02d. MON-05_A10 system audit records are reviewed and analyzed per an organization-defined frequency for indications of organization-defined inappropriate or unusual activity and the potential impact of the inappropriate or unusual activity. Defined parameters: at least weekly Assessment rigor: 3 Origin: 53A_R5_AU-06a. MON-05_A11 findings are reported to organization-defined personnel or roles. Assessment rigor: 3 Origin: 53A_R5_AU-06b. MON-05_A12 the level of audit record review, analysis and reporting within the system is adjusted when there is a change in risk based on law enforcement information, intelligence information or other credible sources of information. Assessment rigor: 3 Origin: 53A_R5_AU-06c. MON-05_A13 system audit records are reviewed and analyzed <A.03.03.05.ODP[01]: frequency> for indications and the potential impact of inappropriate or unusual activity. Defined parameters: at least weekly Assessment rigor: NIST 800-171 Origin: 171A_R3_A.03.03.05.a MON-05_A14 a Security Incident Event Manager (SIEM), or similar automated tool, centrally collects event logs and security-relevant telemetry. Assessment rigor: 1 Origin: SCF Created
MON-05.1 Centralized Event Log & Security-Relevant Telemetry Review & Analysis – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: MON-05.1_A01 the capability to centrally collect, review and analyze event logs and security-relevant telemetry from multiple sources is provided. Assessment rigor: 1 Origin: 53A_R5_AU-06(04)[01] MON-05.1_A02 the capability to centrally collect, review and analyze event logs and security-relevant telemetry from multiple sources is implemented. Assessment rigor: 2 Origin: 53A_R5_AU-06(04)[02]
MON-05.2 Event Log & Security-Relevant Telemetry Analysis & Triage – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: MON-05.2_A01 analysis and triage capabilities for event log and security-relevant telemetry review processes are defined. Assessment rigor: 1 Origin: SCF Created MON-05.2_A02 analysis and triage practices are integrated into event log and security-relevant telemetry review processes that support the organization's established incident response processes. Assessment rigor: 2 Origin: SCF Created
MON-05.3 Event Log & Security-Relevant Telemetry Review Escalation Matrix – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: MON-05.3_A01 an incident response escalation matrix that is specific to the organization's monitoring practices is developed and maintained. Assessment rigor: 3 Origin: SCF Created
MON-05.4 Automated Tools for Real-Time Event Log & Security-Relevant Telemetry Analysis – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: MON-05.4_A01 a Security Incident Event Manager (SIEM), or similar automated tool, is employed to support near real-time analysis of event logs and security-relevant telemetry. Assessment rigor: 1 Origin: 53A_R5_SI-04(02) MON-05.4_A02 the Security Incident Event Manager (SIEM), or similar automated tool, supports incident escalation based on the results of near real-time analysis. Assessment rigor: 2 Origin: SCF Created
MON-05.5 Automated Incident Responder Alerting – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: MON-05.5_A01 personnel or roles to be alerted when indications of inappropriate or unusual activity with cybersecurity / data privacy implications occur is/are defined. Assessment rigor: 1 Origin: 53A_R5_SI-04(12)_ODP[01] MON-05.5_A02 automated mechanisms used to alert personnel or roles are defined. Assessment rigor: 1 Origin: 53A_R5_SI-04(12)_ODP[02] MON-05.5_A03 activities that trigger alerts to personnel or are defined. Assessment rigor: 1 Origin: 53A_R5_SI-04(12)_ODP[03] MON-05.5_A04 personnel or roles is/are alerted using automated mechanisms when activities that trigger alerts indicate inappropriate or unusual activities with cybersecurity / data privacy implications. Assessment rigor: 1 Origin: 53A_R5_SI-04(12) MON-05.5_A05 findings are reported to organizational personnel or roles. Assessment rigor: 2 Origin: 171A_R3_A.03.03.05.b
MON-06 Monitoring Reporting – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: MON-06_A01 system components that provide an audit record generation capability for the events types are defined. Defined parameters: all information system and network components where audit capability is deployed/available Assessment rigor: 1 Origin: 53A_R5_AU-12_ODP[01] MON-06_A02 audit records include organization-defined audit record content requirements. Assessment rigor: 1 Origin: 53A_R5_AU-12c. MON-06_A03 personnel or roles allowed to select the event types that are to be logged by specific components of the system is/are defined. Assessment rigor: 1 Origin: 53A_R5_AU-12_ODP[02] MON-06_A04 an audit record reduction and report generation capability is implemented that supports on-demand audit record review, analysis and reporting requirements and after-the-fact investigations of incidents that does not alter the original content or time ordering of audit records. Assessment rigor: 1 Origin: 171A_3.3.6[b] 53A_R5_AU-07a.[02] 53A_R5_AU-07b.[02] 53A_R5_AU-07(01)[01] 53A_R5_AU-07(01)[02] 53A_R5_AU-12a. 53A_R5_AU-12b. MON-06_A05 fields within audit records that can be processed, sorted or searched are defined. Assessment rigor: 3 Origin: 53A_R5_AU-07(01)_ODP MON-06_A06 findings are reported to organizational personnel or roles. Assessment rigor: 2 Origin: 171A_R3_A.03.03.05.b MON-06_A07 an audit record reduction and report generation capability that supports audit record review is implemented. Assessment rigor: 2 Origin: 171A_R3_A.03.03.06.a[01] 171A_3.3.6[a] 53A_R5_AU-07a.[01] 53A_R5_AU-07b.[01] MON-06_A08 an audit record reduction and report generation capability that supports audit record analysis is implemented. Assessment rigor: 2 Origin: 171A_R3_A.03.03.06.a[02] 171A_3.3.6[a] 53A_R5_AU-07a.[01] 53A_R5_AU-07b.[01] MON-06_A09 an audit record reduction and report generation capability that supports audit record reporting requirements is implemented. Assessment rigor: 2 Origin: 171A_R3_A.03.03.06.a[03] 171A_3.3.6[a] 53A_R5_AU-07a.[01] 53A_R5_AU-07b.[01] MON-06_A10 an audit record reduction and report generation capability that supports after-the-fact investigations of incidents is implemented. Assessment rigor: 2 Origin: 171A_R3_A.03.03.06.a[04]
MON-06.1 Trend Analysis Reporting – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: MON-06.1_A01 trend analysis is employed to determine if control implementations used in the continuous monitoring process need to be modified based on empirical data. Assessment rigor: 1 Origin: 53A_R5_CA-07(03)[01] MON-06.1_A02 trend analysis is employed to determine if the frequency of continuous monitoring activities used in the continuous monitoring process needs to be modified based on empirical data. Assessment rigor: 1 Origin: 53A_R5_CA-07(03)[02] MON-06.1_A03 trend analysis is employed to determine if the types of activities used in the continuous monitoring process need to be modified based on empirical data. Assessment rigor: 1 Origin: 53A_R5_CA-07(03)[03]
MON-07 Alert Threshold Tuning – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: MON-07_A01 communications traffic for the system is analyzed. Assessment rigor: 1 Origin: 53A_R5_SI-04(13)(a)[01] MON-07_A02 event patterns for the system are analyzed. Assessment rigor: 1 Origin: 53A_R5_SI-04(13)(a)[02] MON-07_A03 profiles representing common traffic are developed. Assessment rigor: 1 Origin: 53A_R5_SI-04(13)(b)[01] MON-07_A04 profiles representing event patterns are developed. Assessment rigor: 1 Origin: 53A_R5_SI-04(13)(b)[02] MON-07_A05 traffic profiles are used in tuning system-monitoring devices. Assessment rigor: 1 Origin: 53A_R5_SI-04(13)(c)[01] MON-07_A06 event profiles are used in tuning system-monitoring devices. Assessment rigor: 1 Origin: 53A_R5_SI-04(13)(c)[02]
MON-08 Correlate Monitoring Information – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: MON-08_A01 authorized use of the system is defined. Assessment rigor: 1 Origin: 171A_3.14.7[a] MON-08_A02 unauthorized use of the system is identified. Assessment rigor: 1 Origin: 171A_3.14.7[b] MON-08_A03 incident information and individual incident responses are correlated to achieve an organization-wide perspective on incident awareness and response. Assessment rigor: 1 Origin: 53A_R5_IR-04(04) MON-08_A04 audit records across different repositories are correlated to gain organization-wide situational awareness. Assessment rigor: 1 Origin: 53A_R5_AU-06(03) 53A_R5_IR-04(04) 53A_R5_SI-04(16) 171A_R3_A.03.03.05.c[02] MON-08_A05 audit record review, analysis and reporting processes for investigation and response to indications of unlawful, unauthorized, suspicious or unusual activity are defined. Assessment rigor: 1 Origin: 171A_3.3.5[a] MON-08_A06 defined audit record review, analysis and reporting processes are correlated. Assessment rigor: 2 Origin: 171A_3.3.5[b]
MON-08.1 Integration of Scanning & Other Monitoring Information – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: MON-08.1_A01 data/information collected from other sources to be analyzed is defined. Assessment rigor: 1 Origin: 53A_R5_AU-06(05)_ODP[02] MON-08.1_A02 information from monitoring physical, cyber and supply chain activities are correlated to achieve integrated, organization-wide situational awareness. Assessment rigor: 1 Origin: 53A_R5_SI-04(17) 53A_R5_AU-06(05)_ODP[01] MON-08.1_A03 analysis of audit records is integrated with analysis of organization-specific criteria to further enhance the ability to identify inappropriate or unusual activity. Assessment rigor: 1 Origin: 53A_R5_AU-06(05)
MON-08.2 Correlation with Physical Monitoring – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: MON-08.2_A01 information from event logs and security-relevant telemetry is correlated with information obtained from monitoring physical access to further enhance the ability to identify suspicious, inappropriate, unusual or malevolent activity. Assessment rigor: 1 Origin: 53A_R5_AU-06(06)
MON-09 Content of Event Logs – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: MON-09_A01 the content of audit records needed to support monitoring, analysis, investigation and reporting of unlawful or unauthorized system activity is defined. Defined parameters: successful and unsuccessful account logon events, account management events, object access, policy change, privilege functions, process tracking, and system events. For Web applications: all administrator activity, authentication checks, authorization checks, data deletions, data access, data changes, and permission changes Assessment rigor: 1 Origin: 171A_3.3.1[b] 171A_3.3.2[a] 53A_R5_AU-02_ODP[01] 53A_R5_AU-02_ODP[02] 53A_R5_AU-02a. 53A_R5_AU-02c.[01] MON-09_A02 audit records contain information that establishes what type of event occurred. Assessment rigor: 1 Origin: 53A_R5_AU-03a. 53A_R5_AU-02c.[02] MON-09_A03 audit records contain information that establishes when the event occurred. Assessment rigor: 1 Origin: 53A_R5_AU-03b. 53A_R5_AU-02c.[02] 171A_R3_A.03.03.02.a.02 MON-09_A04 audit records contain information that establishes where the event occurred. Assessment rigor: 1 Origin: 53A_R5_AU-03c. 53A_R5_AU-02c.[02] 171A_R3_A.03.03.02.a.03 MON-09_A05 audit records contain information that establishes the source of the event. Assessment rigor: 1 Origin: 53A_R5_AU-03d. 53A_R5_AU-02c.[02] 171A_R3_A.03.03.02.a.04 MON-09_A06 audit records contain information that establishes the outcome of the event. Assessment rigor: 1 Origin: 53A_R5_AU-03e. 53A_R5_AU-02c.[02] 171A_R3_A.03.03.02.a.05 MON-09_A07 audit records contain information that establishes the identity of the individuals, subjects, objects, or entities associated with the event. Assessment rigor: 1 Origin: 53A_R5_AU-03f. 171A_R3_A.03.03.02.a.06 MON-09_A08 event logs needed (e.g., event types to be logged) to enable the monitoring, analysis, investigation and reporting of unlawful or unauthorized system activity are specified. Assessment rigor: 2 Origin: 171A_3.3.1[a] MON-09_A09 a rationale is provided for why the event types selected for logging are deemed to be adequate to support after-the-fact investigations of incidents. Assessment rigor: 3 Origin: 53A_R5_AU-02d. MON-09_A10 audit records, once created, contain the defined content. Assessment rigor: 2 Origin: 171A_3.3.1[d] 171A_3.3.2[b] MON-09_A11 the frequency of event types selected for logging are reviewed / updated. Defined parameters: at least weekly Assessment rigor: 3 Origin: 53A_R5_AU-02_ODP[04] MON-09_A12 event types selected for logging within the system are defined. Assessment rigor: 2 Origin: 171A_R3_A.03.03.01.ODP[01] MON-09_A13 the following event types are specified for logging within the system: <A.03.03.01.ODP[01]: event types>. Defined parameters: SDP values: at a minimum and where applicable: (1) Authentication events: (a) Logons (Success/Failure) (b) Logoffs (Success) (2) Security Relevant File and Objects events: (a) Create (Success/Failure) (b) Access (Success/Failure) (c) Delete (Success/Failure) (d) Modify (Success/Failure) (e) Permission Modification (Success/Failure) (f) Ownership Modification (Success/Failure) (3) Export/Writes/downloads to devices/digital media (e.g., CD/DVD, USB, SD) (Success/Failure) (4) Import/Uploads from devices/digital media (e.g., CD/DVD, USB, SD) (Success/Failure) (5) User and Group Management events: (a) User add, delete, modify, disable, lock (Success/Failure) (b) Group/Role add, delete, modify (Success/Failure) 6) Use of Privileged/Special Rights events: (a) Security or audit policy changes (Success/Failure) (b) Configuration changes (Success/Failure) (7) Admin or root-level access (Success/Failure) (8) Privilege/Role escalation (Success/Failure) (9) Audit and security relevant log data accesses (Success/Failure) (10) System reboot, restart, and shutdown (Success/Failure) (11) Print to a device (Success/Failure) (12) Print to a file (e.g., pdf format) (Success/Failure) (13) Application (e.g., Adobe, Firefox, MS Office Suite) initialization (Success/Failure) For additional guidance, see: OMB21-31 ML 1 Assessment rigor: NIST 800-171 Origin: 171A_R3_A.03.03.01.a MON-09_A14 the event types selected for logging are updated <A.03.03.01.ODP[02]: frequency>. Defined parameters: at least every 12 months and after any significant incidents or significant changes to risks Assessment rigor: NIST 800-171 Origin: 171A_R3_A.03.03.01.b[02] MON-09_A15 additional information for audit records is provided, as needed. Assessment rigor: 2 Origin: 171A_R3_A.03.03.02.b
MON-09.1 Audit Trails – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: MON-09.1_A01 the content of the audit records needed to support the ability to uniquely trace users to their actions is defined. Defined parameters: successful and unsuccessful account logon events, account management events, object access, policy change, privilege functions, process tracking, and system events. For Web applications: all administrator activity, authentication checks, authorization checks, data deletions, data access, data changes, and permission changes Assessment rigor: 1 Origin: 171A_3.3.2[a] 53A_R5_AU-02_ODP[01] 53A_R5_AU-02_ODP[02] 53A_R5_AU-02a. 53A_R5_AU-02c.[01] MON-09.1_A02 audit records are created (generated). Assessment rigor: 1 Origin: 171A_3.3.1[c] MON-09.1_A03 audit records contain information that establishes the identity of any individuals, subjects or objects/entities associated with the event. Assessment rigor: 1 Origin: 53A_R5_AU-03f.
MON-10 Event Log & Security-Relevant Telemetry Storage Capacity – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: MON-10_A01 event log and security-relevant telemetry retention requirements are defined. Assessment rigor: 1 Origin: 53A_R5_AU-04_ODP MON-10_A02 event log and security-relevant telemetry storage capacity is allocated to accommodate the defined retention requirements. Assessment rigor: 1 Origin: 53A_R5_AU-04 MON-10_A03 event log and security-relevant telemetry storage utilization is proactively monitored and managed to reduce the likelihood of allocated capacity being exceeded. Assessment rigor: 2 Origin: SCF Created
MON-10.1 Event Log & Security-Relevant Telemetry Storage Capacity Alerting – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: MON-10.1_A01 the personnel, roles and/or locations to be warned when allocated event log and security-relevant telemetry storage volume reaches a percentage of maximum storage capacity are defined. Assessment rigor: 1 Origin: 53A_R5_AU-05(01)_ODP[01] MON-10.1_A02 the time period within which the defined personnel, roles and/or locations are to be warned when allocated event log and security-relevant telemetry storage volume reaches a percentage of maximum storage capacity is defined. Assessment rigor: 1 Origin: 53A_R5_AU-05(01)_ODP[02] MON-10.1_A03 the percentage of maximum event log and security-relevant telemetry storage capacity that triggers a warning is defined. Defined parameters: 75%, or one month before expected negative impact Assessment rigor: 1 Origin: 53A_R5_AU-05(01)_ODP[03] MON-10.1_A04 a warning is provided within the defined time period when allocated event log and security-relevant telemetry storage volume reaches the defined percentage of maximum storage capacity. Assessment rigor: 1 Origin: 53A_R5_AU-05(01)
MON-11 Time Stamps – Assessment Procedure	Assessment Objectives In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that: MON-11_A01 timestamps are recorded for audit records that meet organization-defined granularity of time measurement and that use Coordinated Universal Time, have a fixed local time offset from Coordinated Universal Time or include the local time offset as part of the timestamp. Assessment rigor: 1 Origin: 53A_R5_AU-08b. 171A_3.3.7[b] MON-11_A02 internal system clocks are used to generate time stamps for audit records. Assessment rigor: 1 Origin: 171A_3.3.7[a] 171A_R3_A.03.03.07.a MON-11_A03 granularity of time measurement for audit record time stamps is defined. Defined parameters: one (1) second granularity of time measurement Assessment rigor: 1 Origin: 171A_R3_A.03.03.07.ODP[01] MON-11_A04 time stamps recorded in audit records meet an organization-defined granularity of time measurement. Defined parameters: no coarser than 1 second Assessment rigor: 1 Origin: SCF Created MON-11_A05 time stamps are recorded for audit records that meet <A.03.03.07.ODP[01]: granularity of time measurement>. Defined parameters: a granularity of one (1) second or smaller Assessment rigor: NIST 800-171 Origin: 171A_R3_A.03.03.07.b[01] MON-11_A06 Technology Assets, Applications and/or Services (TAAS) are configured to use an authoritative time source to generate time stamps for event logs and security-relevant telemetry. Assessment rigor: 1 Origin: SCF Created

GOV-01 Security, Compliance & Resilience Governance Policy – Assessment Procedure